Comparing is accessible by users who can refer to the repository.

src/main/scala/app/PullRequestsController.scala

@@ -201,7 +201,7 @@ trait PullRequestsControllerBase extends ControllerBase {
     }
   }
 
-  get("/:owner/:repository/compare")(collaboratorsOnly { forkedRepository =>
+  get("/:owner/:repository/compare")(referrersOnly { forkedRepository =>
     (forkedRepository.repository.originUserName, forkedRepository.repository.originRepositoryName) match {
       case (Some(originUserName), Some(originRepositoryName)) => {
         getRepository(originUserName, originRepositoryName, baseUrl).map { originRepository =>
@@ -225,7 +225,7 @@ trait PullRequestsControllerBase extends ControllerBase {
     }
   })
 
-  get("/:owner/:repository/compare/*...*")(collaboratorsOnly { repository =>
+  get("/:owner/:repository/compare/*...*")(referrersOnly { repository =>
     val Seq(origin, forked) = multiParams("splat")
     val (originOwner, tmpOriginBranch) = parseCompareIdentifie(origin, repository.owner)
     val (forkedOwner, tmpForkedBranch) = parseCompareIdentifie(forked, repository.owner)
@@ -264,7 +264,8 @@ trait PullRequestsControllerBase extends ControllerBase {
             checkConflict(originOwner, repository.name, originBranch, forkedOwner, repository.name, forkedBranch),
             repository,
             originRepository,
-            forkedRepository)
+            forkedRepository,
+            hasWritePermission(repository.owner, repository.name, context.loginAccount))
         }
       }
       case _ => NotFound

src/main/twirl/pulls/compare.scala.html

@@ -8,7 +8,8 @@
   hasConflict: Boolean,
   repository: service.RepositoryService.RepositoryInfo,
   originRepository: service.RepositoryService.RepositoryInfo,
-  forkedRepository: service.RepositoryService.RepositoryInfo)(implicit context: app.Context)
+  forkedRepository: service.RepositoryService.RepositoryInfo,
+  hasWritePermission: Boolean)(implicit context: app.Context)
 @import context._
 @import view.helpers._
 @import org.eclipse.jgit.diff.DiffEntry.ChangeType
@@ -44,7 +45,7 @@
       }
     </div>
   </div>
-  @if(commits.nonEmpty){
+  @if(commits.nonEmpty && hasWritePermission){
     <div style="margin-bottom: 10px;" id="create-pull-request">
       <a href="#" class="btn" id="show-form">Click to create a pull request for this comparison</a>
     </div>