diff options
| author | Felipe Artur <felipefac@gmail.com> | 2019-04-08 21:21:21 +0300 |
|---|---|---|
| committer | Felipe Artur <felipefac@gmail.com> | 2019-04-09 21:53:56 +0300 |
| commit | ff06452e05b1191ce8649ae6a9e646341ab073ba (patch) | |
| tree | 78546f0bf3854f6737742176644940f1793b672b /app/views/projects | |
| parent | b4165554113a7f9ce9fecd7d169f9a64686b5c44 (diff) | |
Prevent leaking information when issue is moved
Prevent leaking namespace and project names on moved issue links
Diffstat (limited to 'app/views/projects')
| -rw-r--r-- | app/views/projects/issues/show.html.haml | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/views/projects/issues/show.html.haml b/app/views/projects/issues/show.html.haml index 2c95ac6dbb3..dc01bfa24ca 100644 --- a/app/views/projects/issues/show.html.haml +++ b/app/views/projects/issues/show.html.haml @@ -15,7 +15,7 @@ .issuable-status-box.status-box.status-box-issue-closed{ class: issue_button_visibility(@issue, false) } = sprite_icon('mobile-issue-close', size: 16, css_class: 'd-block d-sm-none') .d-none.d-sm-block - - if @issue.moved? + - if @issue.moved? && can?(current_user, :read_issue, @issue.moved_to) - moved_link_start = "<a href=\"#{issue_path(@issue.moved_to)}\" class=\"text-white text-underline\">".html_safe - moved_link_end = '</a>'.html_safe = s_('IssuableStatus|Closed (%{moved_link_start}moved%{moved_link_end})').html_safe % {moved_link_start: moved_link_start, |