diff options
| author | Mark Chao <mchao@gitlab.com> | 2018-12-11 09:32:25 +0300 |
|---|---|---|
| committer | Mark Chao <mchao@gitlab.com> | 2018-12-20 09:32:51 +0300 |
| commit | ed0d691e0dfba54cd8f03706afd011afe4063a7a (patch) | |
| tree | 25efce5071ce983bd99d74546af262075786cd15 /app/controllers | |
| parent | 30c6db8f0354847c275335c120d7218c0098c41f (diff) | |
Block private snippets from being embeddable
Diffstat (limited to 'app/controllers')
| -rw-r--r-- | app/controllers/projects/snippets_controller.rb | 9 | ||||
| -rw-r--r-- | app/controllers/snippets_controller.rb | 8 |
2 files changed, 15 insertions, 2 deletions
diff --git a/app/controllers/projects/snippets_controller.rb b/app/controllers/projects/snippets_controller.rb index a44acb12bdf..255f1f3569a 100644 --- a/app/controllers/projects/snippets_controller.rb +++ b/app/controllers/projects/snippets_controller.rb @@ -75,7 +75,14 @@ class Projects::SnippetsController < Projects::ApplicationController format.json do render_blob_json(blob) end - format.js { render 'shared/snippets/show'} + + format.js do + if @snippet.embeddable? + render 'shared/snippets/show' + else + head :not_found + end + end end end diff --git a/app/controllers/snippets_controller.rb b/app/controllers/snippets_controller.rb index dd9bf17cf0c..8ea5450b4e8 100644 --- a/app/controllers/snippets_controller.rb +++ b/app/controllers/snippets_controller.rb @@ -80,7 +80,13 @@ class SnippetsController < ApplicationController render_blob_json(blob) end - format.js { render 'shared/snippets/show' } + format.js do + if @snippet.embeddable? + render 'shared/snippets/show' + else + head :not_found + end + end end end |