• Patrick Bajao's avatar
    Don't override approval rules if not allowed · 683274e4
    Patrick Bajao authored
    When `disable_overriding_approvers_per_merge_request` is set to
    `true`, we must not allow anyone to override the approvers per
    merge request.
    
    To ensure this, we shouldn't pass `approval_rules_attributes`
    param when creating or updating a merge request whenever it is not
    allowed to override the approvers per merge request.
    
    Fix is to add a check to `ApprovalRules::ParamsFilteringService`
    to delete the `approval_rules_attributes` from params when it's not
    allowed.
    683274e4
security-372-fix-approvers-override.yml 94 Bytes