User that is not in the white list of the protected branch can update the protected branch by pull request

[diufanman]

• Gitea Version:
  61f5c22 (https://try.gitea.io)

• Git version
  2.7.4

• Operating system:
  Distributor ID: Ubuntu
  Description: Ubuntu 16.04.3 LTS
  Release: 16.04
  Codename: xenial

• Database (use [x]):
  I don't know just try using https://try.gitea.io

• Can you reproduce the bug at https://try.gitea.io:

  • [x ] Yes (provide example URL)
    https://try.gitea.io/cnsze/testing

Description

In the repository cnsze/testing, I

1. Assign user cchai as the collaborator with "Write" permission"
2. protected the branch master, only cnsze can push to the branch master

I tried user cchai cannot push to the master branch (this is correct)

However the master branch can be updated by cchai by pull request

Steps to reproduce the bug:

1. cchai create a pull request (base: master, compare: b1)
2. cchai click the "Merge Pull Request" button
3. the branch master is updated (which is not expected as it suppose to be protected (only the user (which is user "cnsze") in the white list can update it))

[lunny]

Pull request control is the next step on the protected branch setting.

[svarlamov]

This feels like a security bug -- for many people, master is linked to staging or even production environment and we whitelist for a reason... @lunny I'm not too familiar with the related Gitea code for this, do you mind pointing me in the right direction so that I can implement this?

[lafriks]

@svarlamov currently only option would be disable PR tab. It's not really a security bug but missing feature to limit who can merge PR's

[svarlamov]

@lafriks Sure, but I think it ends up being dangerous given that (a) I couldn't find any explicit docs mentioning that and (b) there's no mention of this in the UI where users protect branches. When someone protects a branch, they expect (rightly or wrongly) that only the whitelisted users will be able to touch those branches. Given that's not the case, there should at minimum be a warning. Secondly, could someone point me to the right spot in the code for implementing this protection?