Skip to content

Don't allow removing MR approvers when project setting is set

username-removed-443319 requested to merge fix-approver-permission-checks into master

What does this MR do?

When the disable_overriding_approvers_per_merge_request setting is set, we shouldn't let people remove approvers or groups from merge requests, but should let them do so from the project.

Are there points in the code the reviewer needs to double check?

Should we be prepending for the services? Note that this is tricky for the CreateService.

Why was this MR needed?

When looking at https://gitlab.com/gitlab-org/gitlab-ee/issues/2807, I realised I'd neglected this case in reviewing https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/2016, and a fix to one might fix the other.

Does this MR meet the acceptance criteria?

What are the relevant issue numbers?

Closes https://gitlab.com/gitlab-org/gitlab-ee/issues/2807.

Merge request reports