diff options
| author | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-09-26 16:53:23 +0300 |
|---|---|---|
| committer | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-09-26 16:53:23 +0300 |
| commit | f15977b0458bbb43964cdb476b00cde01b94260f (patch) | |
| tree | 9ea16b83b65bacaa1c06f533a65c196f8e5bc09f /app | |
| parent | 020df25cd84acd8baa1f61be8f32153a7928336b (diff) | |
| parent | a4e04c4c64dd6523643197eb50eb3e8c9d2cbf42 (diff) | |
Merge branch 'security-64938-dont-disclose-path-12-3-ce' into '12-3-stable'
Redirect user to root path after unsubscribing from private resource
See merge request gitlab/gitlabhq!3423
Diffstat (limited to 'app')
| -rw-r--r-- | app/controllers/sent_notifications_controller.rb | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/app/controllers/sent_notifications_controller.rb b/app/controllers/sent_notifications_controller.rb index 51a67cd2e3b..893f5145e99 100644 --- a/app/controllers/sent_notifications_controller.rb +++ b/app/controllers/sent_notifications_controller.rb @@ -19,7 +19,11 @@ class SentNotificationsController < ApplicationController flash[:notice] = _("You have been unsubscribed from this thread.") if current_user - redirect_to noteable_path(noteable) + if current_user.can?(:"read_#{noteable.class.to_ability_name}", noteable) + redirect_to noteable_path(noteable) + else + redirect_to root_path + end else redirect_to new_user_session_path end |