nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Delete branch Permission shown incorrectly

Rahul Mishra4

Hi,

I have an active directory group which i recently downgraded the privileges from 'project creator' to 'stash user' level. However, these users still see the option to delete branches which is something we do not want.

Here are the tests i did -

1) Deleted the group from stash - The users for the group could no longer log in to stash, so i knew they were getting the privileges because of their existence in this group

2) Created a local user and added it to this group, this local user does not have the permission to delete branches.

Any pointers? Is this a bug?

Regards,

Rahul

Accepted answers

Tim Crall1

There is a difference in Stash between being able to log in and what permissions you have on a repo.

If deleting the group from Stash prevented them from logging in at all, that probably means that they lost their license due to not being a member of the group. It doesn't necessarily mean that they might not also be a member of some other group which doesn't grant Stash licenses but does grant permissions on a particular repo. It's easy to accidentally configure an AD user so that they have permissions on a repo but can't login to Stash.

I recommend using this plugin to see exactly what permissions each user has on a repo as a result of their membership in which groups: https://marketplace.atlassian.com/plugins/com.orbitz.stash.plugins.permission-viewer-plugin/versions#b100000000

However, I think that anyone with 'Write' permission on a repo can delete branches unless there are branch permissions in place. Testing seems to confirm this. So I'm actually more confused why the local user you created wasn't able to delete branches than anything else.

All comments

Tim Crall1

There is a difference in Stash between being able to log in and what permissions you have on a repo.

Tim Crall1

Also, deleting a (merged) branch is relatively harmless. A branch is just a pointer to a commit - deleting the branch doesn't delete the commit(s). Deleting an unmerged branch is a little more dangerous, but Stash warns you before allowing you to complete the operation. And presumably those commits would still exist on a developer's clone of the repo.

Rahul Mishra4

Actually i had verified that but i do understand your point.

And, I seemed to have overlooked something. All users (local and A/D based) can delete branches even with the most basic privileges

The plugin was a great suggestion though. Made the issue clearer and caused more confusion. Anyone with 'write' privileges can delete any branch irrespective of branch permissions.

I completely understand that in git it can all be restored (merged or unmerged), but my concern is from a compliance perspective. We have access controls all over the place and the fact that a user can delete a branch (essentially manage a repository) with the bare minimum privileges is discomforting.

I really hoped deletion of branches and tags would require higher privileges

Tim Crall1

Not having branch permissions on a branch keeps a user from deleting it (but that also means not having permission to push to that branch, requiring the use of pull requests to have your changes merged). I don't think there's a way to be able to push to a branch and not be able to delete it.

Rahul Mishra4

And i am seeing it differently, EVEN IF i restrict permissions to push to 'master' branch for certain users, all users with write 'access' to the repository seem to have the capability to delete the branch.

Tim Crall1

Hrm, I just tried it on my install of Stash and it gave me a "User not permitted: You do not have permission to delete this branch." message.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

bitbucket-server

bitbucket-administration