diff options
author | Jarka Kadlecova <jarka@gitlab.com> | 2017-10-03 10:37:48 +0300 |
---|---|---|
committer | Jarka Kadlecova <jarka@gitlab.com> | 2017-10-03 10:37:48 +0300 |
commit | c488bcd13e6e0405d990608c8695ffabe17ffcae (patch) | |
tree | 7c1e07081e8ccf88fef05a368a8c5bc4d87ceb55 /app/policies | |
parent | 59a6f15cd22621826116446d5f28753c973ba2d1 (diff) | |
parent | bdc50ed779cb0c7d266c0f80f3e66a25da8b1964 (diff) |
Merge branch 'master' of gitlab.com:gitlab-org/gitlab-ce into 18608-lock-issues-v2
# Conflicts:
# db/schema.rb
Diffstat (limited to 'app/policies')
-rw-r--r-- | app/policies/global_policy.rb | 11 | ||||
-rw-r--r-- | app/policies/namespace_policy.rb | 4 |
2 files changed, 15 insertions, 0 deletions
diff --git a/app/policies/global_policy.rb b/app/policies/global_policy.rb index 1be7bbe9953..64e550d19d0 100644 --- a/app/policies/global_policy.rb +++ b/app/policies/global_policy.rb @@ -11,6 +11,8 @@ class GlobalPolicy < BasePolicy with_options scope: :user, score: 0 condition(:access_locked) { @user.access_locked? } + condition(:can_create_fork, scope: :user) { @user.manageable_namespaces.any? { |namespace| @user.can?(:create_projects, namespace) } } + rule { anonymous }.policy do prevent :log_in prevent :access_api @@ -40,6 +42,10 @@ class GlobalPolicy < BasePolicy enable :create_group end + rule { can_create_fork }.policy do + enable :create_fork + end + rule { access_locked }.policy do prevent :log_in end @@ -47,4 +53,9 @@ class GlobalPolicy < BasePolicy rule { ~(anonymous & restricted_public_level) }.policy do enable :read_users_list end + + rule { admin }.policy do + enable :read_custom_attribute + enable :update_custom_attribute + end end diff --git a/app/policies/namespace_policy.rb b/app/policies/namespace_policy.rb index 85b67f0a237..92213f0155e 100644 --- a/app/policies/namespace_policy.rb +++ b/app/policies/namespace_policy.rb @@ -1,10 +1,14 @@ class NamespacePolicy < BasePolicy rule { anonymous }.prevent_all + condition(:personal_project, scope: :subject) { @subject.kind == 'user' } + condition(:can_create_personal_project, scope: :user) { @user.can_create_project? } condition(:owner) { @subject.owner == @user } rule { owner | admin }.policy do enable :create_projects enable :admin_namespace end + + rule { personal_project & ~can_create_personal_project }.prevent :create_projects end |