"Edit" button on forked MR
Overview
The files edit button under the changes tab in a merge request is provided even if the user does not have permission to modify the source fork.
Expected
Edit button is not available if the user does not have permissions to modify the source fork.
Actual
Edit button triggers a request to fork the source project which fails as the destination matches the source fork.
Reproduce:
- User A creates project1 (with full namespace: A/project1)
- User B forks project1 (with full namespace: B/project1)
- User B commits/pushes to B/project1
- User B opens a MR against A/project1
- User A navigates to the MR, "Changes" tab
- There, on top of each file listed, it is given the "Edit" option.
- User A click in "Edit" button, the user doesn't have permission to directly edit files in B/project1, GitLab tries to create a fork of B/project1 (for user A) which fails with "Name has already been taken" (the name of that fork would be A/project1, which matches with the name of the original project).
Demonstration:
https://drive.google.com/file/d/0B_4wYK1qcPT1RjF0N045dnp3Q00/view