Re:GitHub “allows” unauthorized users “merging” PRs, bypass ...
by sighingnow on Thursday August 25, 2022 @11:28AM
(#32595023)
> 1) Is it a real problem that allows anyone to push into any repository?
It is not a real problem that allows anyone to push into any repo, but is a real problem that shows a incorrect/unexpected "Merged" pull request status on any repository.
> 2) Is it just a very confusing message?
From the links in paste in the comments you could see that github shows the unauthorized user "merged" the pull request into main, and, the repo's owner received a email says:
FROM: XXXXX
Content: Merged #xxx into main.
It is exactly the SAME as email notification of a normal authorized merge event.
It is not a real problem that allows anyone to push into any repo, but is a real problem that shows a incorrect/unexpected "Merged" pull request status on any repository.
> 2) Is it just a very confusing message?
From the links in paste in the comments you could see that github shows the unauthorized user "merged" the pull request into main, and, the repo's owner received a email says:
FROM: XXXXX Content: Merged #xxx into main.
It is exactly the SAME as email notification of a normal authorized merge event.