diff options
author | Bob Van Landuyt <bob@gitlab.com> | 2018-10-04 19:56:01 +0300 |
---|---|---|
committer | Bob Van Landuyt <bob@vanlanduyt.co> | 2018-10-04 19:58:52 +0300 |
commit | 89ccade810447656d457cff441eff2318b2c7998 (patch) | |
tree | c839d579f2a7828ac63cebcc91b35dd3a6bac768 /lib | |
parent | 21092657a50dbb3430dcf412d8fe448c348c09de (diff) |
Merge branch 'security-bw-confidential-titles-through-markdown-api-11-3' into 'security-11-3'
[11.3] Confidential issue/private snippet titles can be read by unauthenticated user through GFM markdown API
See merge request gitlab/gitlabhq!2535
Diffstat (limited to 'lib')
-rw-r--r-- | lib/api/markdown.rb | 7 | ||||
-rw-r--r-- | lib/banzai.rb | 7 |
2 files changed, 10 insertions, 4 deletions
diff --git a/lib/api/markdown.rb b/lib/api/markdown.rb index 5d55224c1a7..09a8c34c5c0 100644 --- a/lib/api/markdown.rb +++ b/lib/api/markdown.rb @@ -10,7 +10,8 @@ module API detail "This feature was introduced in GitLab 11.0." end post do - context = { only_path: false } + context = { only_path: false, current_user: current_user } + context[:pipeline] = params[:gfm] ? :full : :plain_markdown if params[:project] project = Project.find_by_full_path(params[:project]) @@ -22,9 +23,7 @@ module API context[:skip_project_check] = true end - context[:pipeline] = params[:gfm] ? :full : :plain_markdown - - { html: Banzai.render(params[:text], context) } + { html: Banzai.render_and_post_process(params[:text], context) } end end end diff --git a/lib/banzai.rb b/lib/banzai.rb index 5df98f66f3b..788f29a6c08 100644 --- a/lib/banzai.rb +++ b/lib/banzai.rb @@ -1,4 +1,11 @@ module Banzai + # if you need to render markdown, then you probably need to post_process as well, + # such as removing references that the current user doesn't have + # permission to make + def self.render_and_post_process(text, context = {}) + post_process(render(text, context), context) + end + def self.render(text, context = {}) Renderer.render(text, context) end |