Developers can push to protected branches if pushing multiple branches at once

Users assigned to projects as developers can push to protected branches, while pushing multiple branches at once, e.g. git push --all

Steps to replicate

Starting with a new project, only including an empty README.md file as an example. Import a regular user as developer** member to the project.

The new developer** user can now delete the README.md file, commit the file locally, commit to a new branch and push both branches back to GitLab.

$ git rm README.md
$ git commit -m "Removed readme"

$ git checkout -b test1

$ echo "Hello world" > example.txt
$ git add example.txt
$ git commit -m "Added example"


$ git push --all origin

Username for 'http://gitlab.lan': kpostrup
Password for 'http://kpostrup@gitlab.lan': 
Counting objects: 6, done.
Delta compression using up to 4 threads.
Compressing objects: 100% (2/2), done.
Writing objects: 100% (5/5), 440 bytes | 0 bytes/s, done.
Total 5 (delta 0), reused 0 (delta 0)
To http://gitlab.lan/group/myproject.git
   4661148..e0a1501  master -> master
 * [new branch]      test1 -> test1

I have tested this with Gitlab 7.5.1-omnibus.5.2.0.ci-1 amd64 on Ubuntu 14.04 (LTS)

Results of GitLab Application Check

Checking Environment ...

Git configured for git user? ... yes

Checking Environment ... Finished

Checking GitLab Shell ...

GitLab Shell version >= 2.2.0 ? ... OK (2.2.0)
Repo base directory exists? ... yes
Repo base directory is a symlink? ... no
Repo base owned by git:git? ... yes
Repo base access is drwxrws---? ... yes
Satellites access is drwxr-x---? ... yes
hooks directories in repos are links: ... 
4/1 ... ok
4/2 ... ok
2/3 ... ok
2/4 ... ok
4/6 ... ok
4/7 ... ok
3/8 ... ok
4/9 ... ok
4/12 ... ok
8/13 ... ok
4/15 ... ok
Running /opt/gitlab/embedded/service/gitlab-shell/bin/check
Check GitLab API access: OK
Check directories and files: 
	/var/opt/gitlab/git-data/repositories: OK
	/var/opt/gitlab/.ssh/authorized_keys: OK
Test redis-cli executable: redis-cli 2.8.2
Send ping to redis server: PONG
gitlab-shell self-check successful

Checking GitLab Shell ... Finished

Checking Sidekiq ...

Running? ... yes
Number of Sidekiq processes ... 1

Checking Sidekiq ... Finished

Checking LDAP ...

LDAP is disabled in config/gitlab.yml

Checking LDAP ... Finished

Checking GitLab ...

Database config exists? ... yes
Database is SQLite ... no
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config outdated? ... no
Log directory writable? ... yes
Tmp directory writable? ... yes
Init script exists? ... skipped (omnibus-gitlab has no init script)
Init script up-to-date? ... skipped (omnibus-gitlab has no init script)
projects have namespace: ... 
4/1 ... yes
4/2 ... yes
2/3 ... yes
2/4 ... yes
4/6 ... yes
4/7 ... yes
3/8 ... yes
4/9 ... yes
4/12 ... yes
8/13 ... yes
4/15 ... yes
Projects have satellites? ... 
4/1 ... yes
4/2 ... yes
2/3 ... yes
2/4 ... yes
4/6 ... yes
4/7 ... yes
3/8 ... yes
4/9 ... yes
4/12 ... yes
8/13 ... yes
4/15 ... yes
Redis version >= 2.0.0? ... yes
Ruby version >= 2.0.0 ? ... yes (2.1.4)
Your git bin path is "/opt/gitlab/embedded/bin/git"
Git version >= 1.7.10 ? ... yes (2.0.0)

Checking GitLab ... Finished