Protected branch protection bypassed for non-publishing projects
Upon direct pushes, the protected branch checks on Mercurial projects are actually bypassed.
This doesn't really happen with the default settings because
- protected branches are almost always Mercurial named branches, i.e.,
branch/something
. - mere Developers can't publish changesets, hence a direct push without topic is blocked, since it translates directly into publication.
But projects that disable auto publishing of changesets without topics are affected.
This has been going for a long time, and has to qualify as a security gap, although not a very bad one.