Skip to content

Disallow non-members to unlock project files

Magdalena Frankiewicz requested to merge disallow-non-members-to-unlock-project-files into master

What does this MR do and why?

This MR fixes #276067 (closed)

Please note that is was decided that it can be fixed in the canonical repo

This MR fixes the behavior when User removed from the project is still able to unlock a file, that they locked previously while they were a member of that project. It was possible by going to Repository >> Locked Files in the Project ( https://gitlab.com/[group]/[project]/path_locks). Now non-members are not able to unlock project files anymore.

How to set up and validate locally

  1. Create a public Test Project with a Test File
  2. Invite a UserA with Developer permissions
  3. The User locks the Test File
  4. As Owner of the Test Project, remove the UserA from your project
  5. At this point UserA can't unlock the Test File anymore because they are not a member anymore, neither by going to Repository >> Files >> Test File nor by trying with Repository >> Locked Files in the Test Project ( https://gitlab.com/[group]/[project]/path_locks)

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Magdalena Frankiewicz

Merge request reports