gitlab wrong user permissions

Question

I have installed gitlab 6.4.3 and everything went well. But there is just one weird problem!

Users that are developer, can create merge requests and ALSO ACCEPT THEM !!! I read in gitlab help that a developer can just create new merge requests.

Also the project is private and the users are added by admin as developers.

And there is my gitlab information :

System information
System:     Ubuntu 12.04
Current User:   git
Using RVM:  no
Ruby Version:   2.0.0p353
Gem Version:    2.0.14
Bundler Version:1.5.2
Rake Version:   10.1.0

GitLab information
Version:    6.4.3
Revision:   38397db
Directory:  /home/git/gitlab
DB Adapter: mysql2
URL:        http://git.technical.com
HTTP Clone URL: http://git.technical.com/some-project.git
SSH Clone URL:  git@git.technical.com:some-project.git
Using LDAP: no
Using Omniauth: no

GitLab Shell
Version:    1.8.0
Repositories:   /home/git/repositories/
Hooks:      /home/git/gitlab-shell/hooks/
Git:        /usr/bin/git

Do you have any idea what is going on here? and is there anyway to fix this?

Answer 1

There is no permission for accepting merge request... yet: issue 4763 is about that.

The app/views/projects/merge_requests/show/_mr_accept.html.haml file refers to:

- unless @allowed_to_merge
  .bs-callout
    %strong You don't have permission to merge this MR

And allowed_to_merge is defined by the function in app/controllers/projects/merge_requests_controller.rb:

  def allowed_to_merge?
    action = if project.protected_branch?(@merge_request.target_branch)
               :push_code_to_protected_branches
             else
               :push_code
             end

    can?(current_user, action, @project)
  end

So the only control for now is based on whether or not you can push to the target branch of the merge request.
Nothing more.