Protected branches system (#339)

* Protected branches system

* Moved default branch to branches section (`:org/:reponame/settings/branches`).
* Initial support Protected Branch.
  - Admin does not restrict
  - Owner not to limit
  - To write permission restrictions

* reformat tmpl

* finished the UI and add/delete protected branch response

* remove unused comment

* indent all the template files and remove ru translations since we use crowdin

* fix the push bug

1 files changed, 20 insertions, 0 deletions

diff --git a/cmd/update.go b/cmd/update.go
index 4bbab9a3af..58e60493d0 100644
--- a/cmd/update.go
+++ b/cmd/update.go
@@ -6,9 +6,12 @@ package cmd
 
 import (
 	"os"
+	"strconv"
+	"strings"
 
 	"github.com/urfave/cli"
 
+	"code.gitea.io/git"
 	"code.gitea.io/gitea/models"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
@@ -48,6 +51,23 @@ func runUpdate(c *cli.Context) error {
 		log.GitLogger.Fatal(2, "First argument 'refName' is empty, shouldn't use")
 	}
 
+	// protected branch check
+	branchName := strings.TrimPrefix(args[0], git.BranchPrefix)
+	repoID, _ := strconv.ParseInt(os.Getenv(models.ProtectedBranchRepoID), 10, 64)
+	log.GitLogger.Trace("pushing to %d %v", repoID, branchName)
+	accessMode := models.ParseAccessMode(os.Getenv(models.ProtectedBranchAccessMode))
+	// skip admin or owner AccessMode
+	if accessMode == models.AccessModeWrite {
+		protectBranch, err := models.GetProtectedBranchBy(repoID, branchName)
+		if err != nil {
+			log.GitLogger.Fatal(2, "retrieve protected branches information failed")
+		}
+
+		if protectBranch != nil {
+			log.GitLogger.Fatal(2, "protected branches can not be pushed to")
+		}
+	}
+
 	task := models.UpdateTask{
 		UUID:        os.Getenv("GITEA_UUID"),
 		RefName:     args[0],