repo-forks: stable, security, fix issue when forging fork_repo_id could allow reading other people forks.

rhodecode/controllers/forks.py

@@ -163,10 +163,13 b' class ForksController(BaseRepoController'
         _form = RepoForkForm(old_data={'repo_type': c.repo_info.repo_type},
                              repo_groups=c.repo_groups_choices,
                              landing_revs=c.landing_revs_choices)()
+        post_data = dict(request.POST)
+        post_data['fork_parent_id'] = c.repo_info.repo_id
+
         form_result = {}
         task_id = None
         try:
-            form_result = _form.to_python(dict(request.POST))
+            form_result = _form.to_python(post_data)
             # create fork is done sometimes async on celery, db transaction
             # management is handled there.
             task = RepoModel().create_fork(