diff options
author | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-10-29 18:58:02 +0300 |
---|---|---|
committer | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-10-29 18:58:02 +0300 |
commit | ca324614b5da3f1bb2fcab44cc6c483a712939b7 (patch) | |
tree | 463d377338a0718f4107366cc0b8b8a39be4723b /app/models | |
parent | 64d59e7e1cdd7ede2f308665cc482869150db4fe (diff) | |
parent | 920c7a4abe28dac1d1b26098ece2d912c01d9584 (diff) |
Merge branch 'security-33689-post-filter-search-results-ce' into 'master'
Filter out search results based on permissions to avoid bugs leaking data
See merge request gitlab/gitlabhq!3493
Diffstat (limited to 'app/models')
-rw-r--r-- | app/models/discussion.rb | 1 | ||||
-rw-r--r-- | app/models/milestone.rb | 4 | ||||
-rw-r--r-- | app/models/note.rb | 4 | ||||
-rw-r--r-- | app/models/project.rb | 4 |
4 files changed, 13 insertions, 0 deletions
diff --git a/app/models/discussion.rb b/app/models/discussion.rb index 0d066d0d99f..b8525f7b135 100644 --- a/app/models/discussion.rb +++ b/app/models/discussion.rb @@ -16,6 +16,7 @@ class Discussion :commit_id, :for_commit?, :for_merge_request?, + :noteable_ability_name, :to_ability_name, :editable?, :visible_for?, diff --git a/app/models/milestone.rb b/app/models/milestone.rb index 2fa0cfc9b93..a9f4cdec901 100644 --- a/app/models/milestone.rb +++ b/app/models/milestone.rb @@ -261,6 +261,10 @@ class Milestone < ApplicationRecord group || project end + def to_ability_name + model_name.singular + end + def group_milestone? group_id.present? end diff --git a/app/models/note.rb b/app/models/note.rb index 43f349c6fa2..ce60413b8a0 100644 --- a/app/models/note.rb +++ b/app/models/note.rb @@ -361,6 +361,10 @@ class Note < ApplicationRecord end def to_ability_name + model_name.singular + end + + def noteable_ability_name for_snippet? ? noteable.class.name.underscore : noteable_type.demodulize.underscore end diff --git a/app/models/project.rb b/app/models/project.rb index b5046bbb6ee..f12adc489a2 100644 --- a/app/models/project.rb +++ b/app/models/project.rb @@ -1265,6 +1265,10 @@ class Project < ApplicationRecord end end + def to_ability_name + model_name.singular + end + # rubocop: disable CodeReuse/ServiceClass def execute_hooks(data, hooks_scope = :push_hooks) run_after_commit_or_now do |