Bug #5192
closed
[API] Disallow changing the name of a repository record (by non-admin users)
Added by Peter Amstutz almost 10 years ago.
Updated almost 10 years ago.
Assigned To:
Radhika Chippada
Description
Currently, a regular user can rename a repository, but the new name will resolve to a new empty repository: the content of the existing repository does not move with the name (but you can go back to the old content by renaming the repository record again).
Short term fix is to disallow changing the name attribute of a repository unless current_user.andand.is_admin.
Longer term fix is #4253.
- Subject changed from [API] Renaming repository results in gitolite creating a new repository to [API] Renaming repository results in a new repository
- Description updated (diff)
- Description updated (diff)
- Target version changed from Bug Triage to 2015-03-11 sprint
- Subject changed from [API] Renaming repository results in a new repository to [API] Disallow changing the name of a repository record
- Description updated (diff)
- Category set to API
- Story points deleted (
0.5)
- Assigned To set to Radhika Chippada
- Status changed from New to In Progress
- Subject changed from [API] Disallow changing the name of a repository record to [API] Disallow changing the name of a repository record (by non-admin users)
- Status changed from In Progress to Resolved
Both API and Workbench already disallow a non-admin user from changing a repository name.
- API: repository.rb -> permission_to_update method allows only admin user to update a repository. A unit test "active user cannot change repo name via can_manage permission" exists in api/test/unit/permission_test.rb
- Workbench: Workbench hides the "Attributes" tab from non-admin users. In addition, repository.rb -> editable_attributes returns an empty array for non-admin users and allows only admin users to update the object.
Also available in: Atom
PDF
Updated by 
Updated by 
Updated by 
Updated by Radhika Chippada