From a99a426ce05121d543db709457d531ded90dc143 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Dec 03 2019 10:34:07 +0000
Subject: Drop two early return statements that by-pass the check for PR only


Basically, we were returning True before we had a chance to check if
the project allowed to direct commits vs enforcing a PR only workflow.
RCM and releng are not concerned by this though.

Fixes https://pagure.io/pagure/issue/4248

Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>

---

diff --git a/dist_git_auth.py b/dist_git_auth.py
index 9625f8f..4fde76e 100644
--- a/dist_git_auth.py
+++ b/dist_git_auth.py
@@ -235,7 +235,6 @@ class DistGitAuth(GitAuthHelper):
                 return False
             elif is_supported is True:
                 self.debug("Branch %s is supported" % refname)
-                return is_committer
             else:
                 self.debug("No supported status available")
 
@@ -246,14 +245,16 @@ class DistGitAuth(GitAuthHelper):
                 return False
 
             # Block second level blacklists
-            for entry in self.unspecified_blacklist:
-                if entry.match(refname):
-                    self.info("Unspecified ref %s is blocked" % refname)
-                    return False
+            if not is_supported:
+                # if a branch is not supported, check if the user is allowed
+                # to push to/create it.
+                for entry in self.unspecified_blacklist:
+                    if entry.match(refname):
+                        self.info("Unspecified ref %s is blocked" % refname)
+                        return False
 
             # For unspecified refs, they can push if they're a committer
             self.debug("Unspecified branch push")
-            return is_committer
 
         # This is outside of the strongly protected namespaces
         if repotype == "main":