Do you know of a concrete example of is this "in case"?

I could see this for push mirroring, but not pull mirrors or remote PRs...

PRs when automatic CI is enabled comes to mind, this might pose a security thread to the CI machine.

But you can't auto-file remote PRs, a human has to file them, right?

Well the CI thing that @karsten mentioned is one reason. Another reason is policy/legal. For the deployment of Pagure that I'm running, all the code inside must be authored (committed) by people inside the company. We can't guarantee that with remote PRs.

And yes, people can still grab random stuff from the internet, push it to their forks and then create PRs, but at least there's a chance that they'll review the code going through their hands and will be explicitly signed off on the commits.

This requires:

• adding new configuration key
• disabling new_remote_request_pull in pagure.ui.fork.py based on this configuration key
• hiding the button in the UI based on this configuration key
• some tests to ensure these behaviors
• doc

Rough time estimate: a week

Commit 9f48c1f fixes this issue