Inconsistent permissions check for adding README with UI
Given I go to the empty project
If I am a guest I can see link "add README.md". Clicking to this link takes me to 403 page. Expected behavior - I should not see this link at all as I don't have permissions anyway.
If I am a reporter I can see link "add README.md" and a can see a form after following that link. Submitting that form shows me a 403 page. Expected behavior - I should not see the link that invited me to add readme file.
Activity
I just tried these exact steps on a new 8.1 installation, and it worked fine for me. But I did duplicate the error by adding a reporter user to the project and using the reporter to commit the README. I think there just needs to be a check to prevent rendering the "Add README" link if the user doesn't have access to push.
Edited by Stan Humentioned in merge request !1626 (merged)
-
@vsizov, can you try this again and see if you hit the error? Can you check that your user has at least developer access to the repository?
I observed it for EE. I tested this with CE as well and I see "Commit was rejected because branch received new push"
Edited by Valery Sizov-
I have seen occasional commit hook errors while working locally as in #3114 (closed), but I have never seen an outright 403 error. I could see an issue if your session expired/cookies were cleared before you hit submit.
Edited by Stan Hu -
@stanhu I know what the problem. I'll edit this issue. Let me 5 minutes.
-
@stanhu I edited the issue. Not sure if this is a regression though.
Edited by Valery Sizov -
/cc @rspeicher
-
@vsizov Hah, so the fix I posted in !1626 (merged) will fix this problem. :)
Status changed to closed by merge request !1626 (merged)
mentioned in commit 6a81e51c
mentioned in commit 4eac37fd
mentioned in commit f810fab7
mentioned in issue #12518 (closed)
mentioned in merge request !14785