Commit 207f34b8 authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets

Merge pull request #6190 from...

Merge pull request #6190 from Popl7/add-better-branch-protection-against-history-rewrite-and-deletion

protect protected branched to force updates
parents 6594ce1d 8b35b208
...@@ -10,6 +10,7 @@ module API ...@@ -10,6 +10,7 @@ module API
# project - project path with namespace # project - project path with namespace
# action - git action (git-upload-pack or git-receive-pack) # action - git action (git-upload-pack or git-receive-pack)
# ref - branch name # ref - branch name
# forced_push - forced_push
# #
get "/allowed" do get "/allowed" do
# Check for *.wiki repositories. # Check for *.wiki repositories.
...@@ -35,7 +36,8 @@ module API ...@@ -35,7 +36,8 @@ module API
project, project,
params[:ref], params[:ref],
params[:oldrev], params[:oldrev],
params[:newrev] params[:newrev],
params[:forced_push]
) )
end end
......
...@@ -5,7 +5,7 @@ module Gitlab ...@@ -5,7 +5,7 @@ module Gitlab
attr_reader :params, :project, :git_cmd, :user attr_reader :params, :project, :git_cmd, :user
def allowed?(actor, cmd, project, ref = nil, oldrev = nil, newrev = nil) def allowed?(actor, cmd, project, ref = nil, oldrev = nil, newrev = nil, forced_push = false)
case cmd case cmd
when *DOWNLOAD_COMMANDS when *DOWNLOAD_COMMANDS
if actor.is_a? User if actor.is_a? User
...@@ -19,12 +19,12 @@ module Gitlab ...@@ -19,12 +19,12 @@ module Gitlab
end end
when *PUSH_COMMANDS when *PUSH_COMMANDS
if actor.is_a? User if actor.is_a? User
push_allowed?(actor, project, ref, oldrev, newrev) push_allowed?(actor, project, ref, oldrev, newrev, forced_push)
elsif actor.is_a? DeployKey elsif actor.is_a? DeployKey
# Deploy key not allowed to push # Deploy key not allowed to push
return false return false
elsif actor.is_a? Key elsif actor.is_a? Key
push_allowed?(actor.user, project, ref, oldrev, newrev) push_allowed?(actor.user, project, ref, oldrev, newrev, forced_push)
else else
raise 'Wrong actor' raise 'Wrong actor'
end end
...@@ -41,10 +41,15 @@ module Gitlab ...@@ -41,10 +41,15 @@ module Gitlab
end end
end end
def push_allowed?(user, project, ref, oldrev, newrev) def push_allowed?(user, project, ref, oldrev, newrev, forced_push)
if user && user_allowed?(user) if user && user_allowed?(user)
action = if project.protected_branch?(ref) action = if project.protected_branch?(ref)
if forced_push
:force_push_code_to_protected_branches
else
:push_code_to_protected_branches :push_code_to_protected_branches
end
else else
:push_code :push_code
end end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment