diff options
| author | Yorick Peterse <yorickpeterse@gmail.com> | 2019-02-27 17:23:47 +0300 |
|---|---|---|
| committer | Yorick Peterse <yorickpeterse@gmail.com> | 2019-02-27 17:23:47 +0300 |
| commit | 969855d54f243bb09287bc72901f897223bced99 (patch) | |
| tree | 9b1a0c2c1d7e63f1d7a0f3eb01df6888d939b37a /lib/api | |
| parent | b7cfcb5a67c2ab12b2e47f46021be1b0693ab400 (diff) | |
| parent | 9820da44788bde97700693565fd43f1d5054c007 (diff) | |
Merge branch 'security-tags-oracle-11-7' into '11-7-stable'
Prevent Releases links API to leak tag existence
See merge request gitlab/gitlabhq!2909
Diffstat (limited to 'lib/api')
| -rw-r--r-- | lib/api/release/links.rb | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/api/release/links.rb b/lib/api/release/links.rb index e3072684ef7..5d1b40e3bff 100644 --- a/lib/api/release/links.rb +++ b/lib/api/release/links.rb @@ -8,6 +8,8 @@ module API RELEASE_ENDPOINT_REQUIREMETS = API::NAMESPACE_OR_PROJECT_REQUIREMENTS .merge(tag_name: API::NO_SLASH_URL_PART_REGEX) + before { authorize! :read_release, user_project } + params do requires :id, type: String, desc: 'The ID of a project' end |