Commit 9eca67c9 authored by Douwe Maan's avatar Douwe Maan Committed by Fatih Acet

Verify user is signed in and can actually resolve conflicts

parent cf4cbb01
......@@ -28,6 +28,8 @@ class Projects::MergeRequestsController < Projects::ApplicationController
# Allow modify merge_request
before_action :authorize_update_merge_request!, only: [:close, :edit, :update, :remove_wip, :sort]
before_action :authorize_can_resolve_conflicts!, only: [:conflicts, :resolve_conflicts]
def index
terms = params['issue_search']
@merge_requests = merge_requests_collection
......@@ -368,6 +370,10 @@ class Projects::MergeRequestsController < Projects::ApplicationController
return render_404 unless can?(current_user, :admin_merge_request, @merge_request)
end
def authorize_can_resolve_conflicts!
return render_404 unless @merge_request.conflicts_can_be_resolved_by?(current_user)
end
def module_enabled
return render_404 unless @project.merge_requests_enabled
end
......
......@@ -720,6 +720,11 @@ class MergeRequest < ActiveRecord::Base
@conflicts ||= Gitlab::Conflict::FileCollection.new(self)
end
def conflicts_can_be_resolved_by?(user)
access = ::Gitlab::UserAccess.new(user, project: source_project)
access.can_push_to_branch?(source_branch)
end
def conflicts_can_be_resolved_in_ui?
return @conflicts_can_be_resolved_in_ui if defined?(@conflicts_can_be_resolved_in_ui)
......
......@@ -4,9 +4,11 @@
%p
Please
- if @merge_request.conflicts_can_be_resolved_by?(current_user)
- if @merge_request.conflicts_can_be_resolved_in_ui?
= link_to "resolve these conflicts", conflicts_namespace_project_merge_request_path(@project.namespace, @project, @merge_request)
or
- if @merge_request.can_be_merged_via_command_line_by?(current_user)
#{link_to "merge this request manually", "#modal_merge_info", class: "how_to_merge_link vlink", "data-toggle" => "modal"}.
- else
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment