From 6c435973feb25ee72bceff255eb412e6a571312f Mon Sep 17 00:00:00 2001
From: Marcin Lulek <mlulek@rhodecode.com>
Date: Sat, 18 Nov 2017 19:37:47 +0100
Subject: [PATCH] pull-requests: security, check for permissions on exposure of
 repo-refs

---
 rhodecode/apps/repository/views/repo_pull_requests.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/rhodecode/apps/repository/views/repo_pull_requests.py b/rhodecode/apps/repository/views/repo_pull_requests.py
index 21963dd2..a4b9c0ba 100644
--- a/rhodecode/apps/repository/views/repo_pull_requests.py
+++ b/rhodecode/apps/repository/views/repo_pull_requests.py
@@ -681,6 +681,13 @@ class RepoPullRequestsView(RepoAppView, DataGridAppView):
         repo = Repository.get_by_repo_name(target_repo_name)
         if not repo:
             raise HTTPNotFound()
+
+        target_perm = HasRepoPermissionAny(
+            'repository.read', 'repository.write', 'repository.admin')(
+            target_repo_name)
+        if not target_perm:
+            raise HTTPNotFound()
+
         return PullRequestModel().generate_repo_data(
             repo, translator=self.request.translate)