diff options
| author | Cindy Pallares <cindy@gitlab.com> | 2018-11-28 22:06:02 +0300 |
|---|---|---|
| committer | Cindy Pallares <cindy@gitlab.com> | 2018-11-29 03:13:59 +0300 |
| commit | fe5f75930e781ef854b458fafa307ebb90a8ed2e (patch) | |
| tree | 7160814e28d056568685e8fe84456755ce02fecd /app/controllers/dashboard_controller.rb | |
| parent | e122e14ac6a25c7813ca888a97bd4a3298e78d9d (diff) | |
Merge branch 'security-fix-pat-web-access' into 'master'
[master] Resolve "Personal access token with only `read_user` scope can be used to authenticate any web request"
See merge request gitlab/gitlabhq!2583
Diffstat (limited to 'app/controllers/dashboard_controller.rb')
| -rw-r--r-- | app/controllers/dashboard_controller.rb | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/app/controllers/dashboard_controller.rb b/app/controllers/dashboard_controller.rb index 4ce9be44403..be2d9512c01 100644 --- a/app/controllers/dashboard_controller.rb +++ b/app/controllers/dashboard_controller.rb @@ -4,6 +4,9 @@ class DashboardController < Dashboard::ApplicationController include IssuesAction include MergeRequestsAction + prepend_before_action(only: [:issues]) { authenticate_sessionless_user!(:rss) } + prepend_before_action(only: [:issues_calendar]) { authenticate_sessionless_user!(:ics) } + before_action :event_filter, only: :activity before_action :projects, only: [:issues, :merge_requests] before_action :set_show_full_reference, only: [:issues, :merge_requests] |