diff options
| author | Markus Koller <mkoller@gitlab.com> | 2019-05-31 19:18:09 +0300 |
|---|---|---|
| committer | Markus Koller <mkoller@gitlab.com> | 2019-06-06 10:32:18 +0300 |
| commit | 12d7b3937fa97048d5bd6c09769e837052ebb3db (patch) | |
| tree | 87e7c57422d777e764f646cde551884ba70cca59 /app/helpers | |
| parent | 11bb3b53bcd2b50cb3fe243ac3b778354849cdde (diff) | |
Correctly check permissions when creating snippet notes
In the Snippets::NotesController the noteable was resolved and
authorized through the :snippet_id, so by passing a :target_id for a
different snippet it was possible to create a note on a snippet
where the user would be unauthorized to do so otherwise.
This fixes the problem by ignoring the :target_id and :target_type from
the request, and using the same noteable for creation and authorization.
Diffstat (limited to 'app/helpers')
0 files changed, 0 insertions, 0 deletions