engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

vcs: Only allow 'pull' actions on shadow repositories.

Browse source 
We are exposing the shadow repositories of pull requests to allow easy CI integration
or users to access the pull request shadow repo for investigating on it. But we don't
want someone/something to push changes to a shadow repository.
This commit is contained in:
Martin Bornhold 2016-09-19 15:33:46 +02:00
parent d21d0a537f
commit b23afad92e
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
rhodecode/lib/middleware/simplevcs.py
View file

@ -284,6 +284,15 @@ class SimpleVCS(object):
# ======================================================================
action = self._get_action(environ)
# ======================================================================
# Check if this is a request to a shadow repository of a pull request.
# In this case only pull action is allowed.
# ======================================================================
if self.pr_id is not None and action != 'pull':
reason = 'Only pull action is allowed for shadow repositories.'
log.debug('User not allowed to proceed, %s', reason)
return HTTPNotAcceptable(reason)(environ, start_response)
# ======================================================================
# CHECK ANONYMOUS PERMISSION
# ======================================================================