diff options
author | Yorick Peterse <yorickpeterse@gmail.com> | 2019-01-24 15:47:32 +0300 |
---|---|---|
committer | Yorick Peterse <yorickpeterse@gmail.com> | 2019-01-24 15:47:38 +0300 |
commit | 0481f09b9a4ba8afc6818e532b8035879ffc02d4 (patch) | |
tree | 51333b9a9b9aff00a06da5f93941145372857795 | |
parent | 1493ede681d12c037f2ad2ef92ce56fcb456ae42 (diff) |
Merge branch 'security-2776-fix-add-reaction-permissions-11-5' into 'security-11-5'
[11.5] Revoke award_emoji permissions for confidential issues
See merge request gitlab/gitlabhq!2851
(cherry picked from commit 3826a84830da05489f0147c8efd818cdddbf9143)
31d43bdf Prevent award_emoji to notes not visible to user
-rw-r--r-- | app/policies/note_policy.rb | 1 | ||||
-rw-r--r-- | changelogs/unreleased/security-2776-fix-add-reaction-permissions.yml | 5 | ||||
-rw-r--r-- | spec/policies/note_policy_spec.rb | 2 |
3 files changed, 8 insertions, 0 deletions
diff --git a/app/policies/note_policy.rb b/app/policies/note_policy.rb index f22843b6463..8d23e3abed3 100644 --- a/app/policies/note_policy.rb +++ b/app/policies/note_policy.rb @@ -18,6 +18,7 @@ class NotePolicy < BasePolicy prevent :read_note prevent :admin_note prevent :resolve_note + prevent :award_emoji end rule { is_author }.policy do diff --git a/changelogs/unreleased/security-2776-fix-add-reaction-permissions.yml b/changelogs/unreleased/security-2776-fix-add-reaction-permissions.yml new file mode 100644 index 00000000000..3ad92578c44 --- /dev/null +++ b/changelogs/unreleased/security-2776-fix-add-reaction-permissions.yml @@ -0,0 +1,5 @@ +--- +title: Prevent awarding emojis to notes whose parent is not visible to user +merge_request: +author: +type: security diff --git a/spec/policies/note_policy_spec.rb b/spec/policies/note_policy_spec.rb index 7e25c53e77c..0e848c74659 100644 --- a/spec/policies/note_policy_spec.rb +++ b/spec/policies/note_policy_spec.rb @@ -28,6 +28,7 @@ describe NotePolicy, mdoels: true do expect(policy).to be_disallowed(:admin_note) expect(policy).to be_disallowed(:resolve_note) expect(policy).to be_disallowed(:read_note) + expect(policy).to be_disallowed(:award_emoji) end end @@ -40,6 +41,7 @@ describe NotePolicy, mdoels: true do expect(policy).to be_allowed(:admin_note) expect(policy).to be_allowed(:resolve_note) expect(policy).to be_allowed(:read_note) + expect(policy).to be_allowed(:award_emoji) end end end |