Deny non-fast-forward push for developers

Created by: choehwanjin

Current gitlab implementation adds a developer with "RW+" gitolite permission. According to the gitolite manual, "RW+" permission allows ref deletion. This means every "developer" in gitlab can delete history of their project.

In my opinion, this behavior is dangerous. I suggest to use "RW" permission for developers and "RW+" for project masters.

Created by: choehwanjin

A patch for this issue.

diff --git a/lib/gitlab/gitolite.rb b/lib/gitlab/gitolite.rb
index efb8916..28c5c9b 100644
--- a/lib/gitlab/gitolite.rb
+++ b/lib/gitlab/gitolite.rb
@@ -119,7 +119,7 @@ module Gitlab
       repo.add_permission("R", "", name_readers) unless name_readers.blank?

       # Add write permissions
-      repo.add_permission("RW+", "", name_writers) unless name_writers.blank?
+      repo.add_permission("RW", "", name_writers) unless name_writers.blank?
       repo.add_permission("RW+", "", name_masters) unless name_masters.blank?

       repo

By Administrator on 2012-06-13T10:08:50 (imported from GitLab)

Created by: jtreml

The patch is no longer valid. In the latest version, the corresponding lines can be found towards the end of lib / gitlab / backend / gitolite_config.rb

But I agree. there should be a way to control this behaviour, if not in the GUI, then at least via the config file. I too would prefer to have developers with RW only permissions, not RW+

By Administrator on 2012-10-25T14:32:08 (imported from GitLab)

Created by: riyad

+1

By Administrator on 2012-11-30T20:56:21 (imported from GitLab)

Created by: choehwanjin

A new patch against current master branch:

diff --git a/lib/gitlab/backend/gitolite_config.rb b/lib/gitlab/backend/gitolite_config.rb
index 70ccc47..984098b 100644
--- a/lib/gitlab/backend/gitolite_config.rb
+++ b/lib/gitlab/backend/gitolite_config.rb
@@ -155,7 +155,7 @@ module Gitlab
       repo.add_permission("R", "", name_readers) unless name_readers.blank?

       # Add write permissions
-      repo.add_permission("RW+", "", name_writers) unless name_writers.blank?
+      repo.add_permission("RW", "", name_writers) unless name_writers.blank?
       repo.add_permission("RW+", "", name_masters) unless name_masters.blank?

       # Add sharedRepository config

By Administrator on 2012-12-03T14:53:34 (imported from GitLab)

Created by: elestedt

+1 An ideal solution would be the ability to, as admin, specify custom permissions from GUI.

By Administrator on 2013-02-01T10:18:46 (imported from GitLab)

Created by: elestedt

How was it resolved?

By Administrator on 2013-02-25T17:58:47 (imported from GitLab)

Created by: dosire

I don't think it was resolved. Instead of submitting a patch please provide a pull requests that is valid, has tests and updates the relevant documentation.

By Administrator on 2013-02-27T20:12:28 (imported from GitLab)

Created by: RunsFor

By Administrator on 2014-07-25T07:41:43 (imported from GitLab)