gitlab-org--gitlab-foss/changelogs/unreleased/security-bvl-validate-force-remove-branch-on-mrs.yml

---
title: Don't allow maintainers of a target project to delete the source branch of
  a merge request from a fork
merge_request:
author:
type: security
Only assign merge params when allowed When a user updates a merge request coming from a fork, they should not be able to set `force_remove_source_branch` if they cannot push code to the source project. Otherwise developers of the target project could remove the source branch of the source project by setting this flag through the API. 2019-09-25 12:25:40 -04:00			`---`
			`title: Don't allow maintainers of a target project to delete the source branch of`
			`a merge request from a fork`
			`merge_request:`
			`author:`
			`type: security`