diff options
| author | Felipe Artur <felipefac@gmail.com> | 2017-11-01 21:50:05 +0300 |
|---|---|---|
| committer | Felipe Artur <felipefac@gmail.com> | 2017-11-03 16:26:25 +0300 |
| commit | 3ae5f7900cb222499948eedc982a1830a7402c3c (patch) | |
| tree | f62c6f4e00584378ed07391ed11280f4538cd4fd /app | |
| parent | bfb5107ae720232a15060ee55feba213ee7dd097 (diff) | |
Render 404 when polling commit notes without having permissions
Diffstat (limited to 'app')
| -rw-r--r-- | app/controllers/concerns/notes_actions.rb | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/app/controllers/concerns/notes_actions.rb b/app/controllers/concerns/notes_actions.rb index 1126f706393..fb9c942d302 100644 --- a/app/controllers/concerns/notes_actions.rb +++ b/app/controllers/concerns/notes_actions.rb @@ -4,6 +4,7 @@ module NotesActions included do before_action :set_polling_interval_header, only: [:index] + before_action :noteable, only: :index before_action :authorize_admin_note!, only: [:update, :destroy] before_action :note_project, only: [:create] end @@ -188,7 +189,7 @@ module NotesActions end def noteable - @noteable ||= notes_finder.target + @noteable ||= notes_finder.target || render_404 end def last_fetched_at |