diff options
author | Sean McGivern <sean@gitlab.com> | 2017-04-25 17:41:26 +0300 |
---|---|---|
committer | Lin Jen-Shin <godfat@godfat.org> | 2017-05-04 18:13:07 +0300 |
commit | 0690531ec62cf08a2e596f2de87d224480e34422 (patch) | |
tree | 561d574b052c99f7962c7b99edae6dcf3e7496ba /app | |
parent | ed662aa6ca24400ea4e7ed8e2d3888084bfc4e45 (diff) |
Merge branch 'snippets_visibility' into 'security'
Fix snippets visibility for show action - external users can not see internal snippets
See merge request !2087
Diffstat (limited to 'app')
-rw-r--r-- | app/controllers/snippets_controller.rb | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/app/controllers/snippets_controller.rb b/app/controllers/snippets_controller.rb index f3fd3da8b20..56d7da1ba64 100644 --- a/app/controllers/snippets_controller.rb +++ b/app/controllers/snippets_controller.rb @@ -80,20 +80,20 @@ class SnippetsController < ApplicationController protected def snippet - @snippet ||= if current_user - PersonalSnippet.where("author_id = ? OR visibility_level IN (?)", - current_user.id, - [Snippet::PUBLIC, Snippet::INTERNAL]). - find(params[:id]) - else - PersonalSnippet.find(params[:id]) - end + @snippet ||= PersonalSnippet.find_by(id: params[:id]) end + alias_method :awardable, :snippet alias_method :spammable, :snippet def authorize_read_snippet! - authenticate_user! unless can?(current_user, :read_personal_snippet, @snippet) + return if can?(current_user, :read_personal_snippet, @snippet) + + if current_user + render_404 + else + authenticate_user! + end end def authorize_update_snippet! |