Skip to content

Make it harder to delete issuables accidentally

Stan Hu requested to merge sh-add-delete-confirmation-ee into master

Previously submitting a DELETE request to an issuable (e.g. merge request, issue, etc.) URL would be enough to destroy it, but this should require human confirmation. We now require that the destroy_confirm parameter is set to a truthy value before this can complete.

In addition, we log a Sentry error if a deletion arrived without confirmation.

Related to https://gitlab.com/gitlab-org/gitlab-ce/issues/62387

CE port: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/32376

Edited by Michael Kozono

Merge request reports