From ce2de33a5a16676614d693e2bd38066240881830 Mon Sep 17 00:00:00 2001
From: Marcin Kuzminski <marcin@rhodecode.com>
Date: Thu, 26 Oct 2017 10:14:38 +0200
Subject: [PATCH] repo-forks: stable, security, fix issue when forging
 fork_repo_id could allow reading other people forks.

---
 rhodecode/controllers/forks.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rhodecode/controllers/forks.py b/rhodecode/controllers/forks.py
index 4cfc60ad..c860af26 100644
--- a/rhodecode/controllers/forks.py
+++ b/rhodecode/controllers/forks.py
@@ -163,10 +163,13 @@ class ForksController(BaseRepoController):
         _form = RepoForkForm(old_data={'repo_type': c.repo_info.repo_type},
                              repo_groups=c.repo_groups_choices,
                              landing_revs=c.landing_revs_choices)()
+        post_data = dict(request.POST)
+        post_data['fork_parent_id'] = c.repo_info.repo_id
+
         form_result = {}
         task_id = None
         try:
-            form_result = _form.to_python(dict(request.POST))
+            form_result = _form.to_python(post_data)
             # create fork is done sometimes async on celery, db transaction
             # management is handled there.
             task = RepoModel().create_fork(