Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Protect default branch against deletion #11115

Conversation

6543
Copy link
Member

@6543 6543 commented Apr 17, 2020

Although default branch is not offered for deletion in the templates, we need to prevent it both at the router level and in the pre-receive hook.

@6543 6543 mentioned this pull request Apr 17, 2020
@6543 6543 force-pushed the prevent-default-branch-deletion-in-go-code branch from 4e1a99d to 3e4411f Compare May 6, 2020 07:17
@6543 6543 changed the title [WIP] default branch delete protection default branch delete protection May 6, 2020
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label May 6, 2020
routers/repo/branch.go Outdated Show resolved Hide resolved
@zeripath
Copy link
Contributor

zeripath commented May 6, 2020

Also need to add to pre-receive hook

@zeripath
Copy link
Contributor

zeripath commented May 6, 2020

--- a/routers/private/hook.go
+++ b/routers/private/hook.go
@@ -206,6 +206,14 @@ func HookPreReceive(ctx *macaron.Context, opts private.HookOptions) {
 		refFullName := opts.RefFullNames[i]
 
 		branchName := strings.TrimPrefix(refFullName, git.BranchPrefix)
+		if branchName == repo.DefaultBranch && newCommitID == git.EmptySHA {
+			log.Warn("Forbidden: Branch: %s is the default branch in %-v and cannot be deleted", branchName, repo)
+			ctx.JSON(http.StatusForbidden, map[string]interface{}{
+				"err": fmt.Sprintf("branch %s is the default branch and cannot be deleted", branchName),
+			})
+			return
+		}
+
 		protectBranch, err := models.GetProtectedBranchBy(repo.ID, branchName)
 		if err != nil {
 			log.Error("Unable to get protected branch: %s in %-v Error: %v", branchName, repo, err)

@codecov-io
Copy link

Codecov Report

Merging #11115 into master will decrease coverage by 0.01%.
The diff coverage is 20.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master   #11115      +/-   ##
==========================================
- Coverage   43.86%   43.84%   -0.02%     
==========================================
  Files         607      607              
  Lines       86909    86913       +4     
==========================================
- Hits        38121    38110      -11     
- Misses      44090    44100      +10     
- Partials     4698     4703       +5     
Impacted Files Coverage Δ
routers/repo/branch.go 54.54% <20.00%> (-0.81%) ⬇️
modules/process/manager.go 74.69% <0.00%> (-3.62%) ⬇️
services/pull/check.go 52.43% <0.00%> (-3.05%) ⬇️
modules/git/command.go 86.95% <0.00%> (-2.61%) ⬇️
services/pull/pull.go 33.96% <0.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a1f11a0...d8808ad. Read the comment docs.

routers/repo/branch.go Outdated Show resolved Hide resolved
Copy link
Member

@lafriks lafriks left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apart from small nit, looks good

@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels May 6, 2020
@lafriks lafriks added the type/enhancement An improvement of existing functionality label May 6, 2020
@lafriks lafriks added this to the 1.12.0 milestone May 6, 2020
Co-authored-by: Lauris BH <[email protected]>
Copy link
Member

@kolaente kolaente left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good.

@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels May 6, 2020
@zeripath zeripath changed the title default branch delete protection Protect default branch against deletion May 6, 2020
@zeripath zeripath merged commit 505e456 into go-gitea:master May 6, 2020
@6543 6543 deleted the prevent-default-branch-deletion-in-go-code branch May 6, 2020 11:48
ydelafollye pushed a commit to ydelafollye/gitea that referenced this pull request Jul 31, 2020
Although default branch is not offered for deletion in the templates, we need to prevent it both at the router level and in the pre-receive hook.

Co-authored-by: Andrew Thornton <[email protected]>
Co-authored-by: Lauris BH <[email protected]>
@go-gitea go-gitea locked and limited conversation to collaborators Nov 24, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. type/enhancement An improvement of existing functionality
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants