diff options
| author | Jacob Vosmaer <contact@jacobvosmaer.nl> | 2014-05-15 12:03:26 +0400 |
|---|---|---|
| committer | Jacob Vosmaer <contact@jacobvosmaer.nl> | 2014-05-15 12:22:59 +0400 |
| commit | 02b85fd2366bc6c0d3194ab68e13eb6291733c26 (patch) | |
| tree | cf4686486389c4cc2df7637c9111a01a8afc8bc6 /lib/api | |
| parent | 34fd557055e027b6423241e73b7cf26c741c0b6b (diff) | |
Check user access status in API for current_user
Diffstat (limited to 'lib/api')
| -rw-r--r-- | lib/api/helpers.rb | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb index 7ee4b9d1381..654c1f62c6c 100644 --- a/lib/api/helpers.rb +++ b/lib/api/helpers.rb @@ -8,6 +8,11 @@ module API def current_user private_token = (params[PRIVATE_TOKEN_PARAM] || env[PRIVATE_TOKEN_HEADER]).to_s @current_user ||= User.find_by(authentication_token: private_token) + + unless @current_user && Gitlab::UserAccess.allowed?(@current_user) + return nil + end + identifier = sudo_identifier() # If the sudo is the current user do nothing |