diff -r e9ce904b62a9 -r 80f78674c56e src/mercurialserver/access.py
--- a/src/mercurialserver/access.py	Mon Nov 03 11:12:35 2014 +0100
+++ b/src/mercurialserver/access.py	Mon Nov 03 11:12:45 2014 +0100
@@ -25,3 +25,12 @@
         if not allow(ctx):
             raise mercurial.util.Abort(_('%s: access denied for changeset %s') %
                 (__name__, mercurial.node.short(ctx.node())))
+
+def phasehook(ui, repo, hooktype, **kwargs):
+    if hooktype != 'prepushkey':
+        raise mercurial.util.Abort(_('config error - hook type "%s" cannot stop '
+                                     'incoming phase changes') % hooktype)
+    if kwargs.get('namespace') == 'phases':
+        if not ruleset.rules.allow("publish"):
+            raise mercurial.util.Abort(_('%s: access denied for making %s public') %
+                                       (__name__, kwargs['key'][:12]))