A bare repository won’t have a working tree at .., but it may still have
separate working trees created with git worktree. We should protect the
current branch of such working trees from being updated or deleted,
according to receive.denyCurrentBranch.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 builtin/receive-pack.c | 10 +++++-----
 t/t5516-fetch-push.sh  | 11 ++++++++---
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c
index 49b846d960..5efc9bc9fa 100644
--- a/builtin/receive-pack.c
+++ b/builtin/receive-pack.c
@@ -1456,11 +1456,11 @@ static const char *update_worktree(unsigned char *sha1, const struct worktree *w
 		work_tree = worktree->path;
 	else if (git_work_tree_cfg)
 		work_tree = git_work_tree_cfg;
-	else
-		work_tree = "..";
-
-	if (is_bare_repository())
+	else if (is_bare_repository())
 		return "denyCurrentBranch = updateInstead needs a worktree";
+	else
+		work_tree = "..";
+
 	if (worktree)
 		git_dir = get_worktree_git_dir(worktree);
 	if (!git_dir)
@@ -1486,7 +1486,7 @@ static const char *update(struct command *cmd, struct shallow_info *si)
 	struct object_id *old_oid = &cmd->old_oid;
 	struct object_id *new_oid = &cmd->new_oid;
 	int do_update_worktree = 0;
-	const struct worktree *worktree = is_bare_repository() ? NULL : find_shared_symref("HEAD", name);
+	const struct worktree *worktree = find_shared_symref("HEAD", name);
 
 	/* only refs/... are allowed */
 	if (!starts_with(name, "refs/") || check_refname_format(name + 5, 0)) {
diff --git a/t/t5516-fetch-push.sh b/t/t5516-fetch-push.sh
index 4ef4ecbe71..52a4686afe 100755
--- a/t/t5516-fetch-push.sh
+++ b/t/t5516-fetch-push.sh
@@ -1763,20 +1763,25 @@ test_expect_success 'updateInstead with push-to-checkout hook' '
 
 test_expect_success 'denyCurrentBranch and worktrees' '
 	git worktree add new-wt &&
+	git clone --bare . bare.git &&
+	git -C bare.git worktree add bare-wt &&
 	git clone . cloned &&
 	test_commit -C cloned first &&
 	test_config receive.denyCurrentBranch refuse &&
 	test_must_fail git -C cloned push origin HEAD:new-wt &&
+	test_config -C bare.git receive.denyCurrentBranch refuse &&
+	test_must_fail git -C cloned push ../bare.git HEAD:bare-wt &&
 	test_config receive.denyCurrentBranch updateInstead &&
 	git -C cloned push origin HEAD:new-wt &&
-	test_must_fail git -C cloned push --delete origin new-wt
+	test_must_fail git -C cloned push --delete origin new-wt &&
+	test_config -C bare.git receive.denyCurrentBranch updateInstead &&
+	git -C cloned push ../bare.git HEAD:bare-wt &&
+	test_must_fail git -C cloned push --delete ../bare.git bare-wt
 '
 
 test_expect_success 'refuse fetch to current branch of worktree' '
 	test_commit -C cloned second &&
 	test_must_fail git fetch cloned HEAD:new-wt &&
-	git clone --bare . bare.git &&
-	git -C bare.git worktree add bare-wt &&
 	test_must_fail git -C bare.git fetch ../cloned HEAD:bare-wt &&
 	git fetch -u cloned HEAD:new-wt &&
 	git -C bare.git fetch -u ../cloned HEAD:bare-wt
-- 
2.33.1