From 9f48c1fdb2255dcdfb755c32d4e725f395139b55 Mon Sep 17 00:00:00 2001
From: Karsten Hopp <karsten@redhat.com>
Date: Oct 26 2018 15:06:03 +0000
Subject: Disallow remote pull requests


Fixes #3554
If set, remote pull requests will be disabled and not available
anymore as a selection in the PR dropdown menus

Signed-off-by: Karsten Hopp <karsten@redhat.com>

---

diff --git a/doc/configuration.rst b/doc/configuration.rst
index 584859e..05e9509 100644
--- a/doc/configuration.rst
+++ b/doc/configuration.rst
@@ -1119,6 +1119,15 @@ for newer instances.
 Defaults to: ``False``.
 
 
+DISABLE_REMOTE_PR
+~~~~~~~~~~~~~~~~~
+
+In some pagure deployments remote pull requests need to be disabled
+due to legal / policy reasons.
+
+Defaults to: ``False``.
+
+
 PAGURE_CI_SERVICES
 ~~~~~~~~~~~~~~~~~~
 
diff --git a/files/pagure.cfg.sample b/files/pagure.cfg.sample
index a1a9c1d..b119a2b 100644
--- a/files/pagure.cfg.sample
+++ b/files/pagure.cfg.sample
@@ -55,6 +55,11 @@ SALT_EMAIL = '<secret key to be changed>'
 ## that are not covered by this list will not get sent.
 # ALLOWED_EMAIL_DOMAINS = [ 'localhost.localdomain', 'example.com' ]
 
+### Disallow remote pull requests
+## If set, remote pull requests will be disabled and not available
+## anymore as a selection in the PR dropdown menus
+DISABLE_REMOTE_PR = False
+
 ### The URL at which the project is available.
 APP_URL = 'http://localhost.localdomain/'
 ### The URL at which the documentation of projects will be available
diff --git a/pagure/default_config.py b/pagure/default_config.py
index 2a13a42..ef5a28c 100644
--- a/pagure/default_config.py
+++ b/pagure/default_config.py
@@ -136,6 +136,9 @@ REDIS_PORT = 6379
 REDIS_DB = 0
 EVENTSOURCE_PORT = 8080
 
+# Disallow remote pull requests
+DISABLE_REMOTE_PR = False
+
 # Folder where to place the ssh keys for the mirroring feature
 MIRROR_SSHKEYS_FOLDER = "/var/lib/pagure/sshkeys/"
 
diff --git a/pagure/templates/repo_master.html b/pagure/templates/repo_master.html
index 7e20a1a..e0d5bea 100644
--- a/pagure/templates/repo_master.html
+++ b/pagure/templates/repo_master.html
@@ -125,6 +125,7 @@
                             branch_from=branchname or 'master') }}">
                   New Pull Request
                 </a>
+                {% if not config.get('DISABLE_REMOTE_PR', True) %}
                 <a class="dropdown-item"
                    href="{{ url_for(
                             'ui_ns.new_remote_request_pull',
@@ -133,6 +134,7 @@
                             namespace=repo.namespace) }}">
                   New Remote Pull Request
                 </a>
+                {% endif %}
               </div>
             </div>
           {%endif%}
diff --git a/pagure/templates/repo_new_pull_request.html b/pagure/templates/repo_new_pull_request.html
index 007e6b1..572cf69 100644
--- a/pagure/templates/repo_new_pull_request.html
+++ b/pagure/templates/repo_new_pull_request.html
@@ -64,7 +64,7 @@
 
 {% if form and (g.repo_committer or remote_git) %}
 <section class="new_project">
-  {% if remote_git %}
+  {% if remote_git and not (config.get('DISABLE_REMOTE_PR', True)) %}
   <form action="{{ url_for('ui_ns.new_remote_request_pull',
         repo=repo.name,
         username=username,
diff --git a/pagure/ui/fork.py b/pagure/ui/fork.py
index 66bfd81..a7842c1 100644
--- a/pagure/ui/fork.py
+++ b/pagure/ui/fork.py
@@ -1665,6 +1665,9 @@ def new_remote_request_pull(repo, username=None, namespace=None):
 
     repo = flask.g.repo
 
+    if pagure_config.get('DISABLE_REMOTE_PR', True):
+        flask.abort(404, "Remote pull-requests disabled on this server")
+
     if not repo.settings.get("pull_requests", True):
         flask.abort(404, "No pull-request allowed on this project")
 
diff --git a/tests/test_pagure_flask_ui_remote_pr.py b/tests/test_pagure_flask_ui_remote_pr.py
index 1bca997..36b9082 100644
--- a/tests/test_pagure_flask_ui_remote_pr.py
+++ b/tests/test_pagure_flask_ui_remote_pr.py
@@ -244,6 +244,12 @@ class PagureRemotePRtests(tests.Modeltests):
                     'git_repo': os.path.join(self.newpath, 'test'),
                     'confirm': 1,
                 }
+                self.old_value = pagure.config.config['DISABLE_REMOTE_PR']
+                pagure.config.config['DISABLE_REMOTE_PR'] = True
+                output = self.app.post(
+                    '/test/diff/remote', data=data, follow_redirects=True)
+                self.assertEqual(output.status_code, 404)
+                pagure.config.config['DISABLE_REMOTE_PR'] = self.old_value
                 output = self.app.post(
                     '/test/diff/remote', data=data, follow_redirects=True)
                 self.assertEqual(output.status_code, 200)