diff options
author | Douwe Maan <douwe@gitlab.com> | 2018-07-06 12:58:49 +0300 |
---|---|---|
committer | Douwe Maan <douwe@gitlab.com> | 2018-07-06 12:58:49 +0300 |
commit | afb3caac797f5c90af9ff4989a3730299d39e3f1 (patch) | |
tree | 4f84b43ec8de671cb5ce96ae3e147c2dc0f6ef29 /app | |
parent | f5b12225d8ee8686eddeb35b2851d93631f72c89 (diff) | |
parent | a57ec31e4575d5633341143c7b3a4f0a4350c1ec (diff) |
Merge branch 'bvl-wrap-cross-project-group-permissions' into 'master'
Create cross project group features
See merge request gitlab-org/gitlab-ce!20333
Diffstat (limited to 'app')
-rw-r--r-- | app/helpers/groups_helper.rb | 6 | ||||
-rw-r--r-- | app/policies/group_policy.rb | 13 |
2 files changed, 17 insertions, 2 deletions
diff --git a/app/helpers/groups_helper.rb b/app/helpers/groups_helper.rb index 95fea2f18d1..3c5c8bbd71b 100644 --- a/app/helpers/groups_helper.rb +++ b/app/helpers/groups_helper.rb @@ -128,8 +128,10 @@ module GroupsHelper def get_group_sidebar_links links = [:overview, :group_members] - if can?(current_user, :read_cross_project) - links += [:activity, :issues, :boards, :labels, :milestones, :merge_requests] + resources = [:activity, :issues, :boards, :labels, :milestones, + :merge_requests] + links += resources.select do |resource| + can?(current_user, "read_group_#{resource}".to_sym, @group) end if can?(current_user, :admin_group, @group) diff --git a/app/policies/group_policy.rb b/app/policies/group_policy.rb index 520710b757d..ded9fe30eff 100644 --- a/app/policies/group_policy.rb +++ b/app/policies/group_policy.rb @@ -72,6 +72,19 @@ class GroupPolicy < BasePolicy enable :change_visibility_level end + rule { can?(:read_nested_project_resources) }.policy do + enable :read_group_activity + enable :read_group_issues + enable :read_group_boards + enable :read_group_labels + enable :read_group_milestones + enable :read_group_merge_requests + end + + rule { can?(:read_cross_project) & can?(:read_group) }.policy do + enable :read_nested_project_resources + end + rule { owner & nested_groups_supported }.enable :create_subgroup rule { public_group | logged_in_viewable }.enable :view_globally |