Don't allow commits to replace in wrong project

If the change is slated to a different project than the one the
commit was uploaded to, don't permit the replacement to take place.
This could be caused by a simple typo by the user, and we shouldn't
create a corrupt server side state because of it.

Signed-off-by: Shawn O. Pearce <sop@google.com>

1 files changed, 6 insertions, 0 deletions

diff --git a/src/main/java/com/google/gerrit/server/ssh/Receive.java b/src/main/java/com/google/gerrit/server/ssh/Receive.java
index 817d2201c2..7f7057760f 100644
--- a/src/main/java/com/google/gerrit/server/ssh/Receive.java
+++ b/src/main/java/com/google/gerrit/server/ssh/Receive.java
@@ -769,6 +769,12 @@ class Receive extends AbstractGitCommand {
             reject(cmd, "change " + changeId.get() + " closed");
             return null;
           }
+          if (change.getDest() == null
+              || !proj.getNameKey().equals(change.getDest().getParentKey())) {
+            reject(cmd, "change " + changeId.get() + " not in "
+                + proj.getName());
+            return null;
+          }
         } else {
           change = changeCache.get(changeId);
         }