"Edit" button on forked MR

Overview

The files edit button under the changes tab in a merge request is provided even if the user does not have permission to modify the source fork.

Expected

Edit button is not available if the user does not have permissions to modify the source fork.

Actual

Edit button triggers a request to fork the source project which fails as the destination matches the source fork.

Reproduce:

  1. User A creates project1 (with full namespace: A/project1)
  2. User B forks project1 (with full namespace: B/project1)
  3. User B commits/pushes to B/project1
  4. User B opens a MR against A/project1
  5. User A navigates to the MR, "Changes" tab
  6. There, on top of each file listed, it is given the "Edit" option.
  7. User A click in "Edit" button, the user doesn't have permission to directly edit files in B/project1, GitLab tries to create a fork of B/project1 (for user A) which fails with "Name has already been taken" (the name of that fork would be A/project1, which matches with the name of the original project).

Demonstration:

https://drive.google.com/file/d/0B_4wYK1qcPT1RjF0N045dnp3Q00/view

Edited by 🤖 GitLab Bot 🤖