diff options
author | Jeroen Nijhof <jeroen@jeroennijhof.nl> | 2016-01-06 16:55:44 +0300 |
---|---|---|
committer | Jeroen Nijhof <jeroen@jeroennijhof.nl> | 2016-01-06 16:55:44 +0300 |
commit | 9b28220f8874c7ab342286e74f0b21895a2dd777 (patch) | |
tree | 0b2ec2d97a95796893778623adabb975e0224b64 /app/controllers/snippets_controller.rb | |
parent | d4690af8bc283c402e49cb8b3056c7de9d57e886 (diff) | |
parent | 8b39b8cd54bb73b485ee6ea7fc5d3bbfbe07cd5d (diff) |
Merge gitlab.com:gitlab-org/gitlab-ce
Diffstat (limited to 'app/controllers/snippets_controller.rb')
-rw-r--r-- | app/controllers/snippets_controller.rb | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/app/controllers/snippets_controller.rb b/app/controllers/snippets_controller.rb index 9f9f9a92f11..c72df73af46 100644 --- a/app/controllers/snippets_controller.rb +++ b/app/controllers/snippets_controller.rb @@ -1,6 +1,9 @@ class SnippetsController < ApplicationController before_action :snippet, only: [:show, :edit, :destroy, :update, :raw] + # Allow read snippet + before_action :authorize_read_snippet!, only: [:show, :raw] + # Allow modify snippet before_action :authorize_update_snippet!, only: [:edit, :update] @@ -79,10 +82,14 @@ class SnippetsController < ApplicationController [Snippet::PUBLIC, Snippet::INTERNAL]). find(params[:id]) else - PersonalSnippet.are_public.find(params[:id]) + PersonalSnippet.find(params[:id]) end end + def authorize_read_snippet! + authenticate_user! unless can?(current_user, :read_personal_snippet, @snippet) + end + def authorize_update_snippet! return render_404 unless can?(current_user, :update_personal_snippet, @snippet) end |