Merge branch 'security-unauth-protected-branch-delete' into 'master'

[master] Resolve "Unauthorized user can delete protected branch's merge access levels and push access levels"

See merge request gitlab/gitlab-ee!693

config/routes/repository.rb

@@ -58,14 +58,7 @@ scope format: false do
       resource :release, only: [:edit, :update]
     end
 
-    resources :protected_branches, only: [:index, :show, :create, :update, :destroy, :patch], constraints: { id: Gitlab::PathRegex.git_reference_regex } do
-      ## EE-specific
-      scope module: :protected_branches do
-        resources :merge_access_levels, only: [:destroy]
-        resources :push_access_levels, only: [:destroy]
-      end
-    end
-
+    resources :protected_branches, only: [:index, :show, :create, :update, :destroy, :patch], constraints: { id: Gitlab::PathRegex.git_reference_regex }
     resources :protected_tags, only: [:index, :show, :create, :update, :destroy]
   end
 

ee/app/controllers/projects/protected_branches/application_controller.rb

-class Projects::ProtectedBranches::ApplicationController < Projects::ApplicationController
-  protected
-
-  def load_protected_branch
-    @protected_branch = @project.protected_branches.find(params[:protected_branch_id])
-  end
-end

ee/app/controllers/projects/protected_branches/merge_access_levels_controller.rb

-module Projects
-  module ProtectedBranches
-    class MergeAccessLevelsController < ProtectedBranches::ApplicationController
-      before_action :load_protected_branch, only: [:destroy]
-
-      def destroy
-        @merge_access_level = @protected_branch.merge_access_levels.find(params[:id])
-        @merge_access_level.destroy
-
-        redirect_to project_protected_branch_path(@project, @protected_branch),
-                    status: 302,
-                    notice: "Successfully deleted. #{@merge_access_level.humanize} will not be able to merge into this protected branch."
-      end
-    end
-  end
-end

ee/app/controllers/projects/protected_branches/push_access_levels_controller.rb

-module Projects
-  module ProtectedBranches
-    class PushAccessLevelsController < ProtectedBranches::ApplicationController
-      before_action :load_protected_branch, only: [:destroy]
-
-      def destroy
-        @push_access_level = @protected_branch.push_access_levels.find(params[:id])
-        @push_access_level.destroy
-
-        redirect_to project_protected_branch_path(@project, @protected_branch),
-                    status: 302,
-                    notice: "Successfully deleted. #{@push_access_level.humanize} will not be able to push to this protected branch."
-      end
-    end
-  end
-end

ee/app/controllers/projects/protected_tags/application_controller.rb

-class Projects::ProtectedTags::ApplicationController < Projects::ApplicationController
-  protected
-
-  def load_protected_tag
-    @protected_tag = @project.protected_tags.find(params[:protected_tag_id])
-  end
-end

ee/app/controllers/projects/protected_tags/create_access_levels_controller.rb

-module Projects
-  module ProtectedTags
-    class CreateAccessLevelsController < ProtectedTags::ApplicationController
-      before_action :load_protected_tag, only: [:destroy]
-
-      def destroy
-        @create_access_level = @protected_tag.create_access_levels.find(params[:id])
-        @create_access_level.destroy
-
-        redirect_to project_protected_tag_path(@project, @protected_tag),
-                    status: 302,
-                    notice: "Successfully deleted. #{@create_access_level.humanize} will not be able to create this protected tag."
-      end
-    end
-  end
-end