Incorrect URL for compare button on non forked repos not owned by user

[juanpablo-santos]

• Gitea version (or commit ref): 1.7.1
• Git version: 2.14.3
• Operating system: Ubuntu
• Database (use [x]):
  • PostgreSQL
  • [ X] MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • [ X] Yes (see below, you need at least a couple of users to reproduce the bug)
  • No
  • Not relevant
• Log gist:

Description

Hi,

we've recently migrated to 1.7.1, and the compare button is showing the .SignedUserName for repositories which are neither a fork nor owned by the user. This wasn't happening on 1.6.0.

Seems 5c30817 introduced this behaviour, as part of #5877 released on 1.7.1.

How to reproduce

on try.gitea.io, user perry1234 created repo test-repo123 and added perry1235 as a collaborator, with admin rights

test-repo123 has two branches. When perry1235 clicks on the compare button, he gets an incorrect URL (see attached screenshot)

Screenshots

[notgood]

Confirming, copypasting my comment from #3727

Broken for me since today upgrade to 1.7.1.

My scenario: repo owned by organization, no forks, green compare button generates link /orgname/reponame/compare/master...MyUsername:master, which is failing horribly with 404.
Going through Pull Requests->New Pull Request generates /orgname/reponame/compare/master...master, working as expected.

[zeripath]

OK let's try to work out what the links should be. I'm struggling a little with this, I guess it should always be:

Compare the current repo and branch with the base repo and default branch.

So what was the problem in #3727 ? Well the problem is that make pull request is dependent on write access because https://github.com/go-gitea/gitea/blob/master/routers/repo/pull.go#L687 demands it.

[adelowo]

While this is a bug, Can we actually create the fork for the user instead of throwing a 404? I think GitHub does this.

[zeripath]

Hmm. I'm actually thinking we should check perm.CanReadIssuesOrPulls(true) just like we check when creating an issue. (Despite it's name the permission to write to issues/pulls is about assigning assignees etc. not about creating them.)

[zeripath]

So there's a secondary issue that users cannot just type into the query field and type their own repository to move the compare to their repository.