From 087aa356173b844d33f7b9a14428276fd646c47c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9=20Pfeuffer?= <rene.pfeuffer@cloudogu.com>
Date: Mon, 11 Mar 2019 14:19:23 +0100
Subject: [PATCH] Attach merge link only when user has push permission

---
 .../scm/api/v2/resources/RepositoryToRepositoryDtoMapper.java | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/RepositoryToRepositoryDtoMapper.java b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/RepositoryToRepositoryDtoMapper.java
index 9e680b7e5c..67a6f26de5 100644
--- a/scm-webapp/src/main/java/sonia/scm/api/v2/resources/RepositoryToRepositoryDtoMapper.java
+++ b/scm-webapp/src/main/java/sonia/scm/api/v2/resources/RepositoryToRepositoryDtoMapper.java
@@ -64,7 +64,9 @@ public abstract class RepositoryToRepositoryDtoMapper extends BaseMapper<Reposit
         linksBuilder.single(link("incomingDiff", resourceLinks.incoming().diff(repository.getNamespace(), repository.getName())));
       }
       if (repositoryService.isSupported(Command.MERGE)) {
-        linksBuilder.single(link("merge", resourceLinks.merge().merge(repository.getNamespace(), repository.getName())));
+        if (RepositoryPermissions.push(repository).isPermitted()) {
+          linksBuilder.single(link("merge", resourceLinks.merge().merge(repository.getNamespace(), repository.getName())));
+        }
         linksBuilder.single(link("mergeDryRun", resourceLinks.merge().dryRun(repository.getNamespace(), repository.getName())));
       }
     }