diff options
| author | Douwe Maan <douwe@gitlab.com> | 2016-03-29 11:21:48 +0300 |
|---|---|---|
| committer | Douwe Maan <douwe@gitlab.com> | 2016-03-29 11:21:48 +0300 |
| commit | a7ca8689f7e3a71c69c29203821b8e8b44254216 (patch) | |
| tree | 0bb199efb55436638f9b47a4252c35b163c8f0bb /app/controllers | |
| parent | d73e1288595ef673b2d9c3024d7fe3909dac7184 (diff) | |
| parent | 4f07c0a107b86ea23834a6797989963f1a63f5c1 (diff) | |
Merge branch 'fix-14607' into 'master'
Ensure private project snippets are not viewable by unauthorized people
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/14607
See merge request !1946
Diffstat (limited to 'app/controllers')
| -rw-r--r-- | app/controllers/projects/snippets_controller.rb | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/app/controllers/projects/snippets_controller.rb b/app/controllers/projects/snippets_controller.rb index b578b419a46..6d2901a24a4 100644 --- a/app/controllers/projects/snippets_controller.rb +++ b/app/controllers/projects/snippets_controller.rb @@ -3,7 +3,7 @@ class Projects::SnippetsController < Projects::ApplicationController before_action :snippet, only: [:show, :edit, :destroy, :update, :raw] # Allow read any snippet - before_action :authorize_read_project_snippet! + before_action :authorize_read_project_snippet!, except: [:new, :create, :index] # Allow write(create) snippet before_action :authorize_create_project_snippet!, only: [:new, :create] @@ -81,6 +81,10 @@ class Projects::SnippetsController < Projects::ApplicationController @snippet ||= @project.snippets.find(params[:id]) end + def authorize_read_project_snippet! + return render_404 unless can?(current_user, :read_project_snippet, @snippet) + end + def authorize_update_project_snippet! return render_404 unless can?(current_user, :update_project_snippet, @snippet) end |