This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/allura.git
commit 2a81793127a338b96521b26d416bdb219d2ad890 Author: Dave Brondsema <[email protected]> AuthorDate: Thu Jun 4 14:12:27 2026 -0400 [#8607] another perm check for MRs --- Allura/allura/controllers/repository.py | 1 + ForgeGit/forgegit/tests/functional/test_controllers.py | 11 +++++++++++ 2 files changed, 12 insertions(+) diff --git a/Allura/allura/controllers/repository.py b/Allura/allura/controllers/repository.py index 6be33c3fb..228142500 100644 --- a/Allura/allura/controllers/repository.py +++ b/Allura/allura/controllers/repository.py @@ -193,6 +193,7 @@ def request_merge(self, branch=None, **kw): @expose('jinja:allura:templates/repo/request_merge.html') # needed when we "return self.request_merge(...)" @require_post() def do_request_merge(self, **kw): + require_access(c.app.repo, 'admin') try: kw = self.mr_widget.to_python(kw) except formencode.Invalid: diff --git a/ForgeGit/forgegit/tests/functional/test_controllers.py b/ForgeGit/forgegit/tests/functional/test_controllers.py index e6cfa1eee..e2bf0d00c 100644 --- a/ForgeGit/forgegit/tests/functional/test_controllers.py +++ b/ForgeGit/forgegit/tests/functional/test_controllers.py @@ -746,6 +746,17 @@ def test_merge_action_unavailable_to_non_admin(self): '/p/test2/code/request_merge', status=403, extra_environ=dict(username='test-user')) + def test_do_request_merge_unavailable_to_non_admin(self): + self.app.post( + '/p/test2/code/do_request_merge', + params={ + 'source_branch': 'zz', + 'target_branch': 'master', + 'summary': 'summary', + 'description': 'description', + }, + status=403, extra_environ=dict(username='test-user')) + def test_merge_request_detail_view(self): r, mr_num = self._request_merge() assert 'wants to merge' in r
