diff options
| author | Douwe Maan <douwe@gitlab.com> | 2017-06-01 22:00:28 +0300 |
|---|---|---|
| committer | Regis <boudinot.regis@yahoo.com> | 2017-06-02 22:24:17 +0300 |
| commit | 36605e2b1079e7a78c4580153de3225b5dda61ef (patch) | |
| tree | bb2b75c9848ff563bd67b47f30d1b9215ce91512 /app/policies | |
| parent | 883d27144d0a0a62c1e1a5f9f7f36f357632b17d (diff) | |
Merge branch '25934-project-snippet-vis' into 'security-9-2'
Fix visibility when referencing snippets
See merge request !2101
Diffstat (limited to 'app/policies')
| -rw-r--r-- | app/policies/project_snippet_policy.rb | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/app/policies/project_snippet_policy.rb b/app/policies/project_snippet_policy.rb index cf8ff92617f..bc5c4f32f79 100644 --- a/app/policies/project_snippet_policy.rb +++ b/app/policies/project_snippet_policy.rb @@ -1,5 +1,10 @@ class ProjectSnippetPolicy < BasePolicy def rules + # We have to check both project feature visibility and a snippet visibility and take the stricter one + # This will be simplified - check https://gitlab.com/gitlab-org/gitlab-ce/issues/27573 + return unless @subject.project.feature_available?(:snippets, @user) + return unless Ability.allowed?(@user, :read_project, @subject.project) + can! :read_project_snippet if @subject.public? return unless @user |