From 6d79d8ac4cc8e73df2cbc6d6907f7803c4db2949 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Fri, 8 Nov 2024 10:52:16 -0800 Subject: [PATCH] Add permission check when deleting branch after automerge succeed --- services/automerge/automerge.go | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/services/automerge/automerge.go b/services/automerge/automerge.go index 8cb3af0b505..d0310fc52be 100644 --- a/services/automerge/automerge.go +++ b/services/automerge/automerge.go @@ -15,6 +15,7 @@ import ( access_model "code.gitea.io/gitea/models/perm/access" pull_model "code.gitea.io/gitea/models/pull" repo_model "code.gitea.io/gitea/models/repo" + "code.gitea.io/gitea/models/unit" user_model "code.gitea.io/gitea/models/user" "code.gitea.io/gitea/modules/git" "code.gitea.io/gitea/modules/gitrepo" @@ -306,8 +307,16 @@ func handlePullRequestAutoMerge(pullID int64, sha string) { } if pr.Flow == issues_model.PullRequestFlowGithub && scheduledPRM.DeleteBranchAfterMerge { - if err := repo_service.DeleteBranch(ctx, doer, pr.HeadRepo, headGitRepo, pr.HeadBranch); err != nil { - log.Error("deleteBranch after automerge for pull[%d] failed: %v", pr.ID, err) + perm, err := access_model.GetUserRepoPermission(ctx, pr.HeadRepo, doer) + if err != nil { + log.Error("GetUserRepoPermission %-v: %v", pr.HeadRepo, err) + return + } + + if perm.CanWrite(unit.TypeCode) { // default branch and branch protection will be checked in DeleteBranch + if err := repo_service.DeleteBranch(ctx, doer, pr.HeadRepo, headGitRepo, pr.HeadBranch); err != nil { + log.Error("deleteBranch after automerge for pull[%d] failed: %v", pr.ID, err) + } } } }