Restrict rebase a change in web UI to change owner, submitter
To reduce the risk of drive-by rebase trolling in the web UI,
restrict the rebase button to only the change owner, or any user
who has the submit permission granted on this branch. This is
probably a subset of canUpload(), which tends to be more permissive.
Its still reasonable for canUpload() to be slightly more permissive
in most installations. The bar required to do a drive by rebase is
higher, as the user must prepare a Git client, create a commit with
the correct Change-Id, and push it to the server.
Change-Id: I2be0920ed0457aeba4eb11422567449ba66ea863
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/project/ChangeControl.java b/gerrit-server/src/main/java/com/google/gerrit/server/project/ChangeControl.java
index 1a50030..53301b9 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/project/ChangeControl.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/project/ChangeControl.java
@@ -201,7 +201,7 @@
/** Can this user rebase this change? */
public boolean canRebase() {
- return canAddPatchSet();
+ return isOwner() || getRefControl().canSubmit();
}
/** Can this user restore this change? */
