diff options
| author | Yorick Peterse <yorickpeterse@gmail.com> | 2019-01-24 15:50:25 +0300 |
|---|---|---|
| committer | Yorick Peterse <yorickpeterse@gmail.com> | 2019-01-24 15:50:28 +0300 |
| commit | 6aa48a51e40525d4815397fa458bf1eecd653b80 (patch) | |
| tree | 3e894a595fc57eda327f0785ee301867dcbd1185 /app | |
| parent | a8cd5f279b3656ad2a53b4744a19bd25d876a5cb (diff) | |
Merge branch '11-7-security-do-not-process-mr-ref-for-guests' into 'security-11-7'
[11.7] Don't process MR refs for guests in the notes
See merge request gitlab/gitlabhq!2780
(cherry picked from commit f97d526d0837476eccbf6178bfebf1ed01c652eb)
e9793936 Don't process MR refs for guests in the notes
Diffstat (limited to 'app')
| -rw-r--r-- | app/policies/project_policy.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb index bcba03596f2..cadbc5ae009 100644 --- a/app/policies/project_policy.rb +++ b/app/policies/project_policy.rb @@ -405,7 +405,7 @@ class ProjectPolicy < BasePolicy end.enable :read_issue_iid rule do - (can?(:read_project_for_iids) & merge_requests_visible_to_user) | can?(:read_merge_request) + (~guest & can?(:read_project_for_iids) & merge_requests_visible_to_user) | can?(:read_merge_request) end.enable :read_merge_request_iid rule { ~can_have_multiple_clusters & has_clusters }.prevent :add_cluster |