diff --git a/rhodecode/lib/middleware/simplevcs.py b/rhodecode/lib/middleware/simplevcs.py
index 39c4a3ce..1719bb1b 100644
--- a/rhodecode/lib/middleware/simplevcs.py
+++ b/rhodecode/lib/middleware/simplevcs.py
@@ -284,6 +284,15 @@ class SimpleVCS(object):
         # ======================================================================
         action = self._get_action(environ)
 
+        # ======================================================================
+        # Check if this is a request to a shadow repository of a pull request.
+        # In this case only pull action is allowed.
+        # ======================================================================
+        if self.pr_id is not None and action != 'pull':
+            reason = 'Only pull action is allowed for shadow repositories.'
+            log.debug('User not allowed to proceed, %s', reason)
+            return HTTPNotAcceptable(reason)(environ, start_response)
+
         # ======================================================================
         # CHECK ANONYMOUS PERMISSION
         # ======================================================================