From b23afad92e40c08de3d492a5c6cf216431cc3e0f Mon Sep 17 00:00:00 2001 From: Martin Bornhold Date: Mon, 19 Sep 2016 15:33:46 +0200 Subject: [PATCH] vcs: Only allow 'pull' actions on shadow repositories. We are exposing the shadow repositories of pull requests to allow easy CI integration or users to access the pull request shadow repo for investigating on it. But we don't want someone/something to push changes to a shadow repository. --- rhodecode/lib/middleware/simplevcs.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/rhodecode/lib/middleware/simplevcs.py b/rhodecode/lib/middleware/simplevcs.py index 39c4a3ce..1719bb1b 100644 --- a/rhodecode/lib/middleware/simplevcs.py +++ b/rhodecode/lib/middleware/simplevcs.py @@ -284,6 +284,15 @@ class SimpleVCS(object): # ====================================================================== action = self._get_action(environ) + # ====================================================================== + # Check if this is a request to a shadow repository of a pull request. + # In this case only pull action is allowed. + # ====================================================================== + if self.pr_id is not None and action != 'pull': + reason = 'Only pull action is allowed for shadow repositories.' + log.debug('User not allowed to proceed, %s', reason) + return HTTPNotAcceptable(reason)(environ, start_response) + # ====================================================================== # CHECK ANONYMOUS PERMISSION # ======================================================================