Branch protection does not prevent deletion through the web interface #2135

New Issue

GiteaMirror · 2025-11-02T04:25:05-06:00

GiteaMirror commented

2025-11-02 04:25:05 -06:00

Originally created by @jjsat on GitHub (Aug 2, 2018).

Gitea version (or commit ref): 1.4.3 (64 bit)
Git version: 2.16.2.windows.1
Operating system: Windows 10 64 bit
Database:
- PostgreSQL
- MySQL
- MSSQL
- SQLite
Can you reproduce the bug at https://try.gitea.io:
- Yes (provide example URL): https://try.gitea.io/jjsat_test/branch_protection_test
- No
- Not relevant
Log gist:

My understanding of the branch protection mechanism is that it prevents deletion of and force pushing to a branch. Also it is possible to explicitly allow certain users or groups to do a regular, non-forced push to the branch.

The issue is that a whitelisted user (either through group permission or explicitly set) can delete a protected branch through the web interface. I believe this is an error not only because it allows deletion (which was explicitly forbidden), but also because deleting the branch causes a 404 error when trying to view the branch protection settings for the deleted branch. The web interface clearly does not expect a protected branch to be missing.

I also tried this in version 1.5.0 and there it will actually do an internal server error when trying to view the branch settings if there is a deleted and protected branch: "[Macaron] 2018-08-02 19:53:09: Completed GET /Test/testtest/settings/branches 500 Internal Server Error in 198.4688ms"

Screenshots

Settings for example branch "protected_branch":

Branch listing (note that the branch can be deleted):

What happens when clicking on "protected_branch_deleted", which has the same protection settings as "protected_branch" and was deleted through the branch list:

Originally created by @jjsat on GitHub (Aug 2, 2018). - Gitea version (or commit ref): 1.4.3 (64 bit) - Git version: 2.16.2.windows.1 - Operating system: Windows 10 64 bit - Database: - [ ] PostgreSQL - [ ] MySQL - [ ] MSSQL - [x] SQLite - Can you reproduce the bug at https://try.gitea.io: - [x] Yes (provide example URL): https://try.gitea.io/jjsat_test/branch_protection_test - [ ] No - [ ] Not relevant - Log gist: My understanding of the branch protection mechanism is that it prevents deletion of and force pushing to a branch. Also it is possible to explicitly allow certain users or groups to do a regular, non-forced push to the branch. The issue is that a whitelisted user (either through group permission or explicitly set) can delete a protected branch through the web interface. I believe this is an error not only because it allows deletion (which was explicitly forbidden), but also because deleting the branch causes a 404 error when trying to view the branch protection settings for the deleted branch. The web interface clearly does not expect a protected branch to be missing. I also tried this in version 1.5.0 and there it will actually do an internal server error when trying to view the branch settings if there is a deleted and protected branch: "[Macaron] 2018-08-02 19:53:09: Completed GET /Test/testtest/settings/branches 500 Internal Server Error in 198.4688ms" ## Screenshots Settings for example branch "protected_branch": ![grafik](https://user-images.githubusercontent.com/1445782/43601187-ffaa0426-968c-11e8-9d72-f1aa14548486.png) Branch listing (note that the branch can be deleted): ![grafik](https://user-images.githubusercontent.com/1445782/43601315-259b011c-968d-11e8-88eb-3386dd722702.png) What happens when clicking on "protected_branch_deleted", which has the same protection settings as "protected_branch" and was deleted through the branch list: ![grafik](https://user-images.githubusercontent.com/1445782/43601360-42946bf0-968d-11e8-867c-31a833e78fab.png)

GiteaMirror added the issue/critical type/bug topic/security labels 2025-11-02 04:25:05 -06:00

GiteaMirror closed this issue

2025-11-02 04:25:05 -06:00

GiteaMirror referenced this issue

2025-11-02 12:05:58 -06:00

[PR #2135] [MERGED] Fix missing less sources for oauth (backport #1288) #16252

Sign in to join this conversation.