diff options
author | Felipe Artur <felipefac@gmail.com> | 2016-05-10 01:35:37 +0300 |
---|---|---|
committer | Felipe Artur <felipefac@gmail.com> | 2016-05-10 01:35:37 +0300 |
commit | e56e3cdc62f96541b9bd8b7814204e92f1909253 (patch) | |
tree | fc3872d2ba8c02ae552fc583cbdbb163d3340b20 /lib/api | |
parent | ae25c19ee5dcfae8ea977b2014657ecc6c3eaf3d (diff) |
Fix api leaking notes when user is not authorized to read noteable
Diffstat (limited to 'lib/api')
-rw-r--r-- | lib/api/notes.rb | 31 |
1 files changed, 18 insertions, 13 deletions
diff --git a/lib/api/notes.rb b/lib/api/notes.rb index 71a53e6f0d6..4ac08a3e8c4 100644 --- a/lib/api/notes.rb +++ b/lib/api/notes.rb @@ -20,19 +20,24 @@ module API # GET /projects/:id/snippets/:noteable_id/notes get ":id/#{noteables_str}/:#{noteable_id_str}/notes" do @noteable = user_project.send(:"#{noteables_str}").find(params[:"#{noteable_id_str}"]) - - # We exclude notes that are cross-references and that cannot be viewed - # by the current user. By doing this exclusion at this level and not - # at the DB query level (which we cannot in that case), the current - # page can have less elements than :per_page even if - # there's more than one page. - notes = - # paginate() only works with a relation. This could lead to a - # mismatch between the pagination headers info and the actual notes - # array returned, but this is really a edge-case. - paginate(@noteable.notes). - reject { |n| n.cross_reference_not_visible_for?(current_user) } - present notes, with: Entities::Note + read_ability_name = "read_#{@noteable.class.to_s.underscore.downcase}".to_sym + + if can?(current_user, read_ability_name, @noteable) + # We exclude notes that are cross-references and that cannot be viewed + # by the current user. By doing this exclusion at this level and not + # at the DB query level (which we cannot in that case), the current + # page can have less elements than :per_page even if + # there's more than one page. + notes = + # paginate() only works with a relation. This could lead to a + # mismatch between the pagination headers info and the actual notes + # array returned, but this is really a edge-case. + paginate(@noteable.notes). + reject { |n| n.cross_reference_not_visible_for?(current_user) } + present notes, with: Entities::Note + else + render_api_error!("Not found.", 404) + end end # Get a single +noteable+ note |