Don't allow adding or removing review requests for a merged PR

Author: kemzeb

routers/web/repo/issue.go

@@ -2413,6 +2413,15 @@ func UpdatePullReviewRequest(ctx *context.Context) {
 			ctx.Status(http.StatusForbidden)
 			return
 		}
+		if issue.PullRequest.HasMerged {
+			log.Warn(
+				"UpdatePullReviewRequest: cannot add or remove a review for merged PR %-v#%d",
+				issue.Repo.FullName(), issue.PullRequest.Index,
+			)
+			ctx.Status(http.StatusForbidden)
+			return
+		}
+
 		if reviewID < 0 {
 			// negative reviewIDs represent team requests
 			if err := issue.Repo.LoadOwner(ctx); err != nil {