Admins can push on protected branches without permission
Summary
On protected branches, when push action is restricted to only one user, other users can still push if they are admins.
Steps to reproduce
- Have two users: User 1, and User 2. User 2 is Admin.
- protect a branch (master?)
- allow only one user (User 1) to push (0 roles, 1 user, 0 groups)
- push on the protected branch as User 2
What is the current bug behavior?
Push as User 2 is accepted.
Note that it appears the push is correctly rejected when User 2 is a regular user.
Push is also correctly rejected when NO user is allowed to push.
What is the expected correct behavior?
Push as User 2 should be rejected.
Relevant logs and/or screenshots
When another user is allowed to push to protected branch, pushing as User 2 (admin) incorrect behavior:
Pushing to git@gitlab.xxx.yyy:GROUP/REPO.git
Counting objects: 6, done.
Writing objects: 100% (6/6), 514 bytes | 514.00 KiB/s, done.
Total 6 (delta 4), reused 0 (delta 0)
To gitlab.xxx.yyy:GROUP/REPO.git
2c5012f06..dcdb9a87f master -> master
updating local tracking ref 'refs/remotes/origin/master'
When no user is allowed to push to protected branch, pushing as User 2 (admin) (correct behavior):
Pushing to git@gitlab.xxx.yyy:GROUP/REPO.git
Counting objects: 6, done.
Writing objects: 100% (6/6), 514 bytes | 514.00 KiB/s, done.
Total 6 (delta 4), reused 0 (delta 0)
remote: GitLab: You are not allowed to push code to protected branches on this project.
To gitlab.xxx.yyy:GROUP/REPO.git
! [remote rejected] master -> master (pre-receive hook declined)
error: failed to push some refs to 'git@gitlab.xxx.yyy:GROUP/REPO.git'
Output of checks
Results of GitLab environment info
Expand for output related to GitLab environment info
System information System: Debian 9.1 Proxy: no Current User: git Using RVM: no Ruby Version: 2.3.6p384 Gem Version: 2.6.13 Bundler Version:1.13.7 Rake Version: 12.3.0 Redis Version: 3.2.11 Git Version: 2.14.3 Sidekiq Version:5.0.5 Go Version: unknown
GitLab information Version: 10.7.3-ee Revision: 584a495 Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: postgresql DB Version: 9.6.8 URL: https://gitlab.xxx.yyy HTTP Clone URL: https://gitlab.xxx.yyy/some-group/some-project.git SSH Clone URL: git@gitlab.xxx.yyy:some-group/some-project.git Elasticsearch: no Geo: no Using LDAP: yes Using Omniauth: no
GitLab Shell Version: 7.1.2 Repository storage paths:
- default: /var/opt/gitlab/git-data/repositories Hooks: /opt/gitlab/embedded/service/gitlab-shell/hooks Git: /opt/gitlab/embedded/bin/git
Results of GitLab application Check
Expand for output related to the GitLab application check
Checking GitLab Shell ...
GitLab Shell version >= 7.1.2 ? ... OK (7.1.2) Repo base directory exists? default... yes Repo storage directories are symlinks? default... no Repo paths owned by git:root, or git:git? default... yes Repo paths access is drwxrws---? default... yes hooks directories in repos are links: ... 4/3 ... ok 4/4 ... ok 7/8 ... ok 7/9 ... ok 4/10 ... ok 9/11 ... ok 4/13 ... ok 7/14 ... ok 7/15 ... ok 23/23 ... ok 22/35 ... ok 22/36 ... ok 24/40 ... ok 7/41 ... ok 7/42 ... ok 7/43 ... ok 7/44 ... ok 37/45 ... ok 24/47 ... ok 22/49 ... ok 22/51 ... ok 48/52 ... ok 50/53 ... ok 51/54 ... ok 22/55 ... ok 22/56 ... ok 22/57 ... ok 7/58 ... ok 23/59 ... repository is empty 7/61 ... ok 7/62 ... ok 7/64 ... ok 7/70 ... ok 56/71 ... ok 7/72 ... ok 61/73 ... ok 61/74 ... ok 61/75 ... ok 61/76 ... ok 51/77 ... ok 7/78 ... ok 7/79 ... ok 7/81 ... ok 7/82 ... ok 7/83 ... ok 7/84 ... ok 7/85 ... ok 7/86 ... ok 7/87 ... ok 7/88 ... ok 7/89 ... ok 7/90 ... ok 7/91 ... ok 37/92 ... ok 7/93 ... ok 22/94 ... ok 22/95 ... ok 7/96 ... ok 7/97 ... ok 7/98 ... ok 7/99 ... ok 7/100 ... ok 7/101 ... ok 7/102 ... ok 7/103 ... ok 7/104 ... ok 53/105 ... ok 22/108 ... ok 56/109 ... ok 53/110 ... ok 22/111 ... ok 56/112 ... ok 23/113 ... ok 7/114 ... ok 7/115 ... ok 7/116 ... ok 64/118 ... ok 53/120 ... ok 4/121 ... ok 4/122 ... ok 22/123 ... ok 53/124 ... ok 22/126 ... ok 23/130 ... ok 4/132 ... ok 64/133 ... ok 4/134 ... ok 4/135 ... ok 22/136 ... ok 4/137 ... ok 62/138 ... ok 53/139 ... ok 53/140 ... ok 19/141 ... ok 51/142 ... ok 53/144 ... ok 53/145 ... ok 22/146 ... ok 22/147 ... ok 53/148 ... ok 53/149 ... ok 53/150 ... ok 53/151 ... ok 53/152 ... ok 53/153 ... ok 53/154 ... ok 53/157 ... ok 53/158 ... ok 4/159 ... ok 21/160 ... ok 22/161 ... ok 10/162 ... ok 20/163 ... ok 53/164 ... ok 10/166 ... ok 7/167 ... ok 22/170 ... ok 7/172 ... ok 24/173 ... ok 7/176 ... ok 22/177 ... ok 7/179 ... ok 56/180 ... ok 22/182 ... ok 7/183 ... ok 23/186 ... repository is empty 7/188 ... ok 22/189 ... ok 22/193 ... ok 7/195 ... ok 22/196 ... ok 22/197 ... ok 22/198 ... ok 79/200 ... ok 79/201 ... repository is empty 28/202 ... ok 7/203 ... ok 22/204 ... ok 24/205 ... ok 22/207 ... ok 12/208 ... repository is empty 22/209 ... ok 56/210 ... ok 24/211 ... ok 7/213 ... ok 22/214 ... ok 4/215 ... ok 22/216 ... ok 7/217 ... ok 7/218 ... ok 65/219 ... ok 51/220 ... ok 24/221 ... ok 90/222 ... ok 24/223 ... ok 90/224 ... ok 4/225 ... ok 36/226 ... ok 56/227 ... ok 22/228 ... ok 56/229 ... ok 56/230 ... repository is empty 24/231 ... ok 7/232 ... ok 22/233 ... ok 20/234 ... ok 7/235 ... ok 24/236 ... ok 4/237 ... ok 103/238 ... ok 56/239 ... ok 56/240 ... ok 56/241 ... ok 56/242 ... ok 22/243 ... ok 28/244 ... ok 4/245 ... ok 63/246 ... ok 28/247 ... ok 37/248 ... ok 98/249 ... repository is empty 52/250 ... ok 7/251 ... ok 22/252 ... ok 4/253 ... ok 53/254 ... ok 22/255 ... ok 114/256 ... ok 103/257 ... repository is empty 23/258 ... repository is empty 51/259 ... ok 7/261 ... ok 22/262 ... ok 28/263 ... ok 4/264 ... ok 22/266 ... ok 7/267 ... ok 22/268 ... repository is empty Running /opt/gitlab/embedded/service/gitlab-shell/bin/check Check GitLab API access: OK Redis available via internal API: OK
Access to /var/opt/gitlab/.ssh/authorized_keys: OK gitlab-shell self-check successful
Checking GitLab Shell ... Finished
Checking Sidekiq ...
Running? ... yes Number of Sidekiq processes ... 1
Checking Sidekiq ... Finished
Reply by email is disabled in config/gitlab.yml Checking LDAP ...
Server: ldapmain LDAP authentication... Success LDAP users with access to your GitLab server (only showing the first 100 results)
[ --- SNIPPED : LDAP USERS LIST --- ]
Checking LDAP ... Finished
Checking GitLab ...
Git configured correctly? ... yes Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... yes Init script exists? ... skipped (omnibus-gitlab has no init script) Init script up-to-date? ... skipped (omnibus-gitlab has no init script) Projects have namespace: ... 4/3 ... yes 4/4 ... yes 7/8 ... yes 7/9 ... yes 4/10 ... yes 9/11 ... yes 4/13 ... yes 7/14 ... yes 7/15 ... yes 23/23 ... yes 22/35 ... yes 22/36 ... yes 24/40 ... yes 7/41 ... yes 7/42 ... yes 7/43 ... yes 7/44 ... yes 37/45 ... yes 24/47 ... yes 22/49 ... yes 22/51 ... yes 48/52 ... yes 50/53 ... yes 51/54 ... yes 22/55 ... yes 22/56 ... yes 22/57 ... yes 7/58 ... yes 23/59 ... yes 7/61 ... yes 7/62 ... yes 7/64 ... yes 7/70 ... yes 56/71 ... yes 7/72 ... yes 61/73 ... yes 61/74 ... yes 61/75 ... yes 61/76 ... yes 51/77 ... yes 7/78 ... yes 7/79 ... yes 7/81 ... yes 7/82 ... yes 7/83 ... yes 7/84 ... yes 7/85 ... yes 7/86 ... yes 7/87 ... yes 7/88 ... yes 7/89 ... yes 7/90 ... yes 7/91 ... yes 37/92 ... yes 7/93 ... yes 22/94 ... yes 22/95 ... yes 7/96 ... yes 7/97 ... yes 7/98 ... yes 7/99 ... yes 7/100 ... yes 7/101 ... yes 7/102 ... yes 7/103 ... yes 7/104 ... yes 53/105 ... yes 22/108 ... yes 56/109 ... yes 53/110 ... yes 22/111 ... yes 56/112 ... yes 23/113 ... yes 7/114 ... yes 7/115 ... yes 7/116 ... yes 64/118 ... yes 53/120 ... yes 4/121 ... yes 4/122 ... yes 22/123 ... yes 53/124 ... yes 22/126 ... yes 23/130 ... yes 4/132 ... yes 64/133 ... yes 4/134 ... yes 4/135 ... yes 22/136 ... yes 4/137 ... yes 62/138 ... yes 53/139 ... yes 53/140 ... yes 19/141 ... yes 51/142 ... yes 53/144 ... yes 53/145 ... yes 22/146 ... yes 22/147 ... yes 53/148 ... yes 53/149 ... yes 53/150 ... yes 53/151 ... yes 53/152 ... yes 53/153 ... yes 53/154 ... yes 53/157 ... yes 53/158 ... yes 4/159 ... yes 21/160 ... yes 22/161 ... yes 10/162 ... yes 20/163 ... yes 53/164 ... yes 10/166 ... yes 7/167 ... yes 22/170 ... yes 7/172 ... yes 24/173 ... yes 7/176 ... yes 22/177 ... yes 7/179 ... yes 56/180 ... yes 22/182 ... yes 7/183 ... yes 23/186 ... yes 7/188 ... yes 22/189 ... yes 22/193 ... yes 7/195 ... yes 22/196 ... yes 22/197 ... yes 22/198 ... yes 79/200 ... yes 79/201 ... yes 28/202 ... yes 7/203 ... yes 22/204 ... yes 24/205 ... yes 22/207 ... yes 12/208 ... yes 22/209 ... yes 56/210 ... yes 24/211 ... yes 7/213 ... yes 22/214 ... yes 4/215 ... yes 22/216 ... yes 7/217 ... yes 7/218 ... yes 65/219 ... yes 51/220 ... yes 24/221 ... yes 90/222 ... yes 24/223 ... yes 90/224 ... yes 4/225 ... yes 36/226 ... yes 56/227 ... yes 22/228 ... yes 56/229 ... yes 56/230 ... yes 24/231 ... yes 7/232 ... yes 22/233 ... yes 20/234 ... yes 7/235 ... yes 24/236 ... yes 4/237 ... yes 103/238 ... yes 56/239 ... yes 56/240 ... yes 56/241 ... yes 56/242 ... yes 22/243 ... yes 28/244 ... yes 4/245 ... yes 63/246 ... yes 28/247 ... yes 37/248 ... yes 98/249 ... yes 52/250 ... yes 7/251 ... yes 22/252 ... yes 4/253 ... yes 53/254 ... yes 22/255 ... yes 114/256 ... yes 103/257 ... yes 23/258 ... yes 51/259 ... yes 7/261 ... yes 22/262 ... yes 28/263 ... yes 4/264 ... yes 22/266 ... yes 7/267 ... yes 22/268 ... yes Redis version >= 2.8.0? ... yes Ruby version >= 2.3.5 ? ... yes (2.3.6) Git version >= 2.9.5 ? ... yes (2.14.3) Git user has default SSH configuration? ... no Try fixing it: mkdir ~/gitlab-check-backup-1528208876 sudo mv /var/opt/gitlab/.ssh/id_rsa ~/gitlab-check-backup-1528208876 sudo mv /var/opt/gitlab/.ssh/id_rsa.pub ~/gitlab-check-backup-1528208876 For more information see: doc/ssh/README.md in section "SSH on the GitLab server" Please fix the error above and rerun the checks. Active users: ... 71 Elasticsearch version 5.1 - 5.5? ... skipped (elasticsearch is disabled)
Checking GitLab ... Finished