From 20cb4f7ab567062fd67ccd40cd29ff1d2e85d8f0 Mon Sep 17 00:00:00 2001 From: Bob Van Landuyt Date: Wed, 25 Sep 2019 18:25:40 +0200 Subject: Only assign merge params when allowed When a user updates a merge request coming from a fork, they should not be able to set `force_remove_source_branch` if they cannot push code to the source project. Otherwise developers of the target project could remove the source branch of the source project by setting this flag through the API. --- app/services/merge_requests/create_service.rb | 1 - 1 file changed, 1 deletion(-) (limited to 'app/services/merge_requests/create_service.rb') diff --git a/app/services/merge_requests/create_service.rb b/app/services/merge_requests/create_service.rb index 1c730232abb..9a37a0330fc 100644 --- a/app/services/merge_requests/create_service.rb +++ b/app/services/merge_requests/create_service.rb @@ -9,7 +9,6 @@ module MergeRequests merge_request.target_project = @project merge_request.source_project = @source_project merge_request.source_branch = params[:source_branch] - merge_request.merge_params['force_remove_source_branch'] = params.delete(:force_remove_source_branch) create(merge_request) end -- cgit v1.2.1