diff options
| author | Nick Thomas <nick@gitlab.com> | 2019-08-22 18:05:07 +0300 |
|---|---|---|
| committer | Nick Thomas <nick@gitlab.com> | 2019-08-23 14:47:54 +0300 |
| commit | 642f6b38169c5805676f061708d25137f4cc986e (patch) | |
| tree | 0fa7b94a595164c0b8e8338850bc7d4f4c0aa811 /spec/lib/gitlab/slash_commands/command_spec.rb | |
| parent | f7f3b3c3efd58f31ed422808722b0c81a0bf1064 (diff) | |
Send TODOs for comments on commits correctly
At present, the TodoService uses the `:read_project` ability to decide
whether a user can read a note on a commit. However, commits can have a
visibility level that is more restricted than the project, so this is a
security issue.
This commit changes the code to use the `:read_commit` ability in this
case instead, which ensures TODOs are only generated for commit notes
if the users can see the commit.
Diffstat (limited to 'spec/lib/gitlab/slash_commands/command_spec.rb')
0 files changed, 0 insertions, 0 deletions