forks: don't expose fork link if we don't have permission to read it, and also don't pre-select in pull request.

rhodecode/apps/_base/__init__.py

@@ -249,6 +249,12 b' class RepoAppView(BaseAppView):'
             else:  # redirect if we don't show missing requirements
                 raise HTTPFound(h.route_path('home'))
 
+        c.has_origin_repo_read_perm = False
+        if self.db_repo.fork:
+            c.has_origin_repo_read_perm = h.HasRepoPermissionAny(
+                'repository.write', 'repository.read', 'repository.admin')(
+                self.db_repo.fork.repo_name, 'summary fork link')
+
         return c
 
     def _get_f_path_unchecked(self, matchdict, default=None):

rhodecode/apps/repository/views/repo_pull_requests.py

@@ -755,7 +755,7 b' class RepoPullRequestsView(RepoAppView, '
 
         default_target_repo = source_repo
 
-        if source_repo.parent:
+        if source_repo.parent and c.has_origin_repo_read_perm:
             parent_vcs_obj = source_repo.parent.scm_instance()
             if parent_vcs_obj and not parent_vcs_obj.is_empty():
                 # change default if we have a parent repo
@@ -855,6 +855,7 b' class RepoPullRequestsView(RepoAppView, '
         all_target_repos = target_repos + parent_target_repos
 
         repos = []
+        # This checks permissions to the repositories
         for obj in ScmModel().get_repos(all_target_repos):
             repos.append({
                 'id': obj['name'],

rhodecode/templates/base/base.mako

@@ -188,7 +188,7 b''
     %if repo_instance.fork:
     <p>
         <i class="icon-code-fork"></i> ${_('Fork of')}
-        <a href="${h.route_path('repo_summary',repo_name=repo_instance.fork.repo_name)}">${repo_instance.fork.repo_name}</a>
+        ${h.link_to_if(c.has_origin_repo_read_perm,repo_instance.fork.repo_name, h.route_path('repo_summary', repo_name=repo_instance.fork.repo_name))}
     </p>
     %endif