You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@allura.apache.org by br...@apache.org on 2026/06/04 19:01:28 UTC
(allura) 01/02: [#8607] another perm check for MRs
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git
commit 2a81793127a338b96521b26d416bdb219d2ad890
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Thu Jun 4 14:12:27 2026 -0400
[#8607] another perm check for MRs
---
Allura/allura/controllers/repository.py | 1 +
ForgeGit/forgegit/tests/functional/test_controllers.py | 11 +++++++++++
2 files changed, 12 insertions(+)
diff --git a/Allura/allura/controllers/repository.py b/Allura/allura/controllers/repository.py
index 6be33c3fb..228142500 100644
--- a/Allura/allura/controllers/repository.py
+++ b/Allura/allura/controllers/repository.py
@@ -193,6 +193,7 @@ def request_merge(self, branch=None, **kw):
@expose('jinja:allura:templates/repo/request_merge.html') # needed when we "return self.request_merge(...)"
@require_post()
def do_request_merge(self, **kw):
+ require_access(c.app.repo, 'admin')
try:
kw = self.mr_widget.to_python(kw)
except formencode.Invalid:
diff --git a/ForgeGit/forgegit/tests/functional/test_controllers.py b/ForgeGit/forgegit/tests/functional/test_controllers.py
index e6cfa1eee..e2bf0d00c 100644
--- a/ForgeGit/forgegit/tests/functional/test_controllers.py
+++ b/ForgeGit/forgegit/tests/functional/test_controllers.py
@@ -746,6 +746,17 @@ def test_merge_action_unavailable_to_non_admin(self):
'/p/test2/code/request_merge',
status=403, extra_environ=dict(username='test-user'))
+ def test_do_request_merge_unavailable_to_non_admin(self):
+ self.app.post(
+ '/p/test2/code/do_request_merge',
+ params={
+ 'source_branch': 'zz',
+ 'target_branch': 'master',
+ 'summary': 'summary',
+ 'description': 'description',
+ },
+ status=403, extra_environ=dict(username='test-user'))
+
def test_merge_request_detail_view(self):
r, mr_num = self._request_merge()
assert 'wants to merge' in r