Restrict permission to upload patch sets to other users' changes
There are some spammers that upload new patch sets to changes that
belong to other users (e.g. [1]). To prevent that this happens again
we grant the 'Add Patch Set' permission [2] only to the Gerrit
maintainers and the gerrit-verifiers group which contains all trusted
Gerrit contributors. Block the 'Add Patch Set' permission for
Anonymous-Users since on the All-Projects project this permission is
granted for Registered-Users).
This means only Gerrit maintainers and users of the gerrit-verifiers
group can now upload new patch sets to changes that they do not own.
Everyone is still allowed to upload patch sets to own changes since
this is always allowed regardless of the 'Add Patch Set' permission.
[1] https://gerrit-review.googlesource.com/c/plugins/javamelody/+/192431/10..11//COMMIT_MSG
[2] https://gerrit-review.googlesource.com/Documentation/access-control.html#category_add_patch_set
Change-Id: I99263899fa3a82cbefbc20550b2e07dfd9414184
diff --git a/project.config b/project.config
index b8fe757..89f94c4 100644
--- a/project.config
+++ b/project.config
@@ -43,3 +43,7 @@
push = group google/gerritcodereview-maintainers@googlegroups.com
pushMerge = group Project Owners
pushMerge = group google/gerritcodereview-maintainers@googlegroups.com
+[access "refs/for/*"]
+ addPatchSet = group google/gerritcodereview-maintainers@googlegroups.com
+ addPatchSet = group gerrit-verifiers
+ addPatchSet = block group Anonymous Users
