From d7e95d77d845baf656d9be4e2cc077f7d426d7a8 Mon Sep 17 00:00:00 2001
From: Lin Jen-Shin <godfat@godfat.org>
Date: Mon, 14 Aug 2017 22:55:34 +0800
Subject: [PATCH] Use with_repo_branch_commit instead of fetch_ref directly

So that we could limit the access to Repository#fetch_ref
See: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/13416#note_37487433
---
 app/models/merge_request.rb              | 17 ++++++++---------
 spec/requests/api/merge_requests_spec.rb |  3 +--
 2 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/app/models/merge_request.rb b/app/models/merge_request.rb
index daee7c93995..ac08dc0ee1f 100644
--- a/app/models/merge_request.rb
+++ b/app/models/merge_request.rb
@@ -940,14 +940,13 @@ class MergeRequest < ActiveRecord::Base
   private
 
   def write_ref
-    if for_fork?
-      target_project.repository.fetch_ref(
-        source_project.repository.path_to_repo,
-        "refs/heads/#{source_branch}",
-        ref_path
-      )
-    else
-      source_project.repository.write_ref(ref_path, source_branch_sha)
-    end
+    target_project.repository.with_repo_branch_commit(
+      source_project.repository, source_branch) do |commit|
+        if commit
+          target_project.repository.write_ref(ref_path, commit.sha)
+        else
+          raise Rugged::ReferenceError, 'source repository is empty'
+        end
+      end
   end
 end
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index 7b7d84f9bbf..0db645863fb 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -583,8 +583,7 @@ describe API::MergeRequests do
       before do
         fork_project.add_reporter(user2)
 
-        allow_any_instance_of(Repository).to receive(:fetch_ref) # for forks
-        allow_any_instance_of(Repository).to receive(:write_ref) # for non-forks
+        allow_any_instance_of(MergeRequest).to receive(:write_ref)
       end
 
       it "returns merge_request" do