diff options
| author | Nick Thomas <nick@gitlab.com> | 2019-11-19 19:17:35 +0300 |
|---|---|---|
| committer | Nick Thomas <nick@gitlab.com> | 2019-11-25 14:48:47 +0300 |
| commit | 644d125b9adeb20c0a7dfcd3dee2db7b7c1b6f2e (patch) | |
| tree | ee8997f3669991d2cacd672bcc01621d464cddcc /lib | |
| parent | 4c442bdda212490c660a4c0acd82d03f60d72dc9 (diff) | |
Check permissions before showing a forked project's source
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/api/entities.rb | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/api/entities.rb b/lib/api/entities.rb index 9617f1a8acf..32a0fb9dd60 100644 --- a/lib/api/entities.rb +++ b/lib/api/entities.rb @@ -283,7 +283,9 @@ module API expose :shared_runners_enabled expose :lfs_enabled?, as: :lfs_enabled expose :creator_id - expose :forked_from_project, using: Entities::BasicProjectDetails, if: lambda { |project, options| project.forked? } + expose :forked_from_project, using: Entities::BasicProjectDetails, if: ->(project, options) do + project.forked? && Ability.allowed?(options[:current_user], :read_project, project.forked_from_project) + end expose :import_status expose :import_error, if: lambda { |_project, options| options[:user_can_admin_project] } do |project| |