Skip to content

Fix non-admins unable to automerge PRs from forks#36833

Merged
wxiaoguang merged 5 commits intogo-gitea:mainfrom
Enzime:push-rmlwrooyqnro
Mar 6, 2026
Merged

Fix non-admins unable to automerge PRs from forks#36833
wxiaoguang merged 5 commits intogo-gitea:mainfrom
Enzime:push-rmlwrooyqnro

Conversation

@Enzime
Copy link
Copy Markdown
Contributor

@Enzime Enzime commented Mar 5, 2026

If a user with write access to a repo (but not a site admin) tries to automerge a PR from a fork they don't have write access to, the automerge fails with the following error in the logs:

automerge.go:259:handlePullRequestAutoMerge() [E]
  <PullRequest [11]user2/repo1#6[master...user5/repo1-automerge-fork:master]>
  CheckPullMergeable: no permission to merge

I believe this occurs because handlePullRequestAutoMerge checks the permissions of the merging user against the fork (pr.HeadRepo) instead of against the destination repo (pr.BaseRepo).

I used Opus 4.6 to debug this issue, write the fix and the regression test. I've manually tested this fix on my own Gitea instance and I've tested that the regression test correctly fails without the fix and succeeds with the fix :)

@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Mar 5, 2026
@github-actions github-actions bot added the modifies/go Pull requests that update Go code label Mar 5, 2026
@wxiaoguang
Copy link
Copy Markdown
Contributor

wxiaoguang commented Mar 5, 2026 •
edited
Loading

If admin user (user1) wasn't used for testing, the bug should have been caught by existing tests in early days .....

@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Mar 5, 2026
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Mar 5, 2026
@wxiaoguang wxiaoguang enabled auto-merge (squash) March 5, 2026 23:34
@wxiaoguang wxiaoguang merged commit c710ce3 into go-gitea:main Mar 6, 2026
26 checks passed
@GiteaBot GiteaBot added this to the 1.26.0 milestone Mar 6, 2026
zjjhot added a commit to zjjhot/gitea that referenced this pull request Mar 6, 2026
@zjjhot
Merge remote-tracking branch 'giteaofficial/main'
9ad2bd8 
* giteaofficial/main:
  Fix non-admins unable to automerge PRs from forks (go-gitea#36833)
  upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (go-gitea#36837)
  Fix dump release asset bug (go-gitea#36799)
  build(deps): update material-icon-theme v5.32.0 (go-gitea#36832)
  Fix bug to check whether user can update pull request branch or rebase branch (go-gitea#36465)
  Fix forwarded proto handling for public URL detection (go-gitea#36810)
  Fix artifacts v4 backend upload problems (go-gitea#36805)
  Add a git grep search timeout (go-gitea#36809)
  fix(repo): unify DEFAULT_SHOW_FULL_NAME output in templates and dropdown (go-gitea#36597)
  Harden render iframe open-link handling (go-gitea#36811)
@GiteaBot
Copy link
Copy Markdown
Collaborator

GiteaBot commented Mar 6, 2026

I was unable to create a backport for 1.25. @Enzime, please send one manually. 🍵

go run ./contrib/backport 36833
...  // fix git conflicts if any
go run ./contrib/backport --continue

@GiteaBot GiteaBot added the backport/manual No power to the bots! Create your backport yourself! label Mar 6, 2026
lunny added a commit to lunny/gitea that referenced this pull request Mar 6, 2026
@Enzime @wxiaoguang @lunny
Fix non-admins unable to automerge PRs from forks (go-gitea#36833)
b0e2aa3 
Make `handlePullRequestAutoMerge` correctly check the
permissions of the merging user against pr.BaseRepo.

---------

Co-authored-by: Michael Hoang <enzime@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
@lunny lunny mentioned this pull request Mar 6, 2026
Merged
@lunny lunny added the backport/done All backports for this PR have been created label Mar 6, 2026
@Enzime Enzime deleted the push-rmlwrooyqnro branch March 6, 2026 13:04
silverwind added a commit to silverwind/gitea that referenced this pull request Mar 6, 2026
@silverwind
Merge remote-tracking branch 'origin/main' into fixmerge
f626aa0 
* origin/main: (27 commits)
  Fix OAuth2 authorization code expiry and reuse handling (go-gitea#36797)
  Fix org permission API visibility checks for hidden members and private orgs (go-gitea#36798)
  Fix non-admins unable to automerge PRs from forks (go-gitea#36833)
  upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (go-gitea#36837)
  Fix dump release asset bug (go-gitea#36799)
  build(deps): update material-icon-theme v5.32.0 (go-gitea#36832)
  Fix bug to check whether user can update pull request branch or rebase branch (go-gitea#36465)
  Fix forwarded proto handling for public URL detection (go-gitea#36810)
  Fix artifacts v4 backend upload problems (go-gitea#36805)
  Add a git grep search timeout (go-gitea#36809)
  fix(repo): unify DEFAULT_SHOW_FULL_NAME output in templates and dropdown (go-gitea#36597)
  Harden render iframe open-link handling (go-gitea#36811)
  [skip ci] Updated translations via Crowdin
  fix: /repos/{owner}/{repo}/actions/{runs,jobs} requiring owner permissions (go-gitea#36818)
  Fix CRAN package version validation to allow more than 4 version components (go-gitea#36813)
  Fix API not persisting pull request unit config when has_pull_requests is not set (go-gitea#36718)
  feat: Add Actions API rerun endpoints for runs and jobs (go-gitea#36768)
  Fix bug when pushing mirror with wiki (go-gitea#36795)
  Pull Request Pusher should be the author of the merge (go-gitea#36581)
  Delete non-exist branch should return 404 (go-gitea#36694)
  ...

# Conflicts:
#	routers/web/repo/issue_view.go
silverwind added a commit to silverwind/gitea that referenced this pull request Mar 6, 2026
@silverwind
Merge branch 'main' into up
d623eae 
* main:
  Fix dbfs error handling (go-gitea#36844)
  Fix OAuth2 authorization code expiry and reuse handling (go-gitea#36797)
  Fix org permission API visibility checks for hidden members and private orgs (go-gitea#36798)
  Fix non-admins unable to automerge PRs from forks (go-gitea#36833)
  upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (go-gitea#36837)

# Conflicts:
#	go.mod
#	go.sum
silverwind pushed a commit that referenced this pull request Mar 8, 2026
@lunny @Enzime @wxiaoguang
Fix non-admins unable to automerge PRs from forks (#36833) (#36843)
4f562da 
backport #36833 

Make `handlePullRequestAutoMerge` correctly check the permissions of the
merging user against pr.BaseRepo.

Co-authored-by: Michael Hoang <10492681+Enzime@users.noreply.github.com>
Co-authored-by: Michael Hoang <enzime@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
silverwind added a commit to silverwind/gitea that referenced this pull request Mar 8, 2026
@silverwind
Merge branch 'main' into cm
8df7e3f 
* main: (26 commits)
  Clean up `refreshViewedFilesSummary` (go-gitea#36868)
  Remove `util.URLJoin` and replace all callers with direct path concatenation (go-gitea#36867)
  Optimize Docker build with dependency layer caching (go-gitea#36864)
  Fix URLJoin, markup render link reoslving, sign-in/up/linkaccount page common data (go-gitea#36861)
  Fix CodeQL code scanning alerts (go-gitea#36858)
  Refactor auth middleware (go-gitea#36848)
  Update Nix flake (go-gitea#36857)
  Update JS deps (go-gitea#36850)
  Load `mentionValues` asynchronously (go-gitea#36739)
  [skip ci] Updated translations via Crowdin
  Fix dbfs error handling (go-gitea#36844)
  Fix OAuth2 authorization code expiry and reuse handling (go-gitea#36797)
  Fix org permission API visibility checks for hidden members and private orgs (go-gitea#36798)
  Fix non-admins unable to automerge PRs from forks (go-gitea#36833)
  upgrade to github.com/cloudflare/circl 1.6.3, svgo 4.0.1, markdownlint-cli 0.48.0 (go-gitea#36837)
  Fix dump release asset bug (go-gitea#36799)
  build(deps): update material-icon-theme v5.32.0 (go-gitea#36832)
  Fix bug to check whether user can update pull request branch or rebase branch (go-gitea#36465)
  Fix forwarded proto handling for public URL detection (go-gitea#36810)
  Fix artifacts v4 backend upload problems (go-gitea#36805)
  ...

# Conflicts:
#	pnpm-lock.yaml
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lunny lunny lunny approved these changes

@wxiaoguang wxiaoguang wxiaoguang approved these changes

Assignees

No one assigned

Labels

backport/done All backports for this PR have been created backport/manual No power to the bots! Create your backport yourself! backport/v1.25 lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. modifies/go Pull requests that update Go code type/bug

Projects

None yet

Milestone

1.26.0

Development

Successfully merging this pull request may close these issues.

4 participants

@Enzime @wxiaoguang @GiteaBot @lunny