From fb93142488cfb79bac45f184b7945018550bf326 Mon Sep 17 00:00:00 2001 From: Felipe Artur Date: Thu, 8 Aug 2019 16:29:45 -0300 Subject: Prevent disclosure of merge request id via email Do not disclosure merge request id via email for unauthorized users when closing issues. --- app/mailers/emails/issues.rb | 2 ++ 1 file changed, 2 insertions(+) (limited to 'app/mailers') diff --git a/app/mailers/emails/issues.rb b/app/mailers/emails/issues.rb index f3a3203f7ad..0bba2a8bf24 100644 --- a/app/mailers/emails/issues.rb +++ b/app/mailers/emails/issues.rb @@ -34,6 +34,8 @@ module Emails setup_issue_mail(issue_id, recipient_id, closed_via: closed_via) @updated_by = User.find(updated_by_user_id) + @recipient = User.find(recipient_id) + mail_answer_thread(@issue, issue_thread_options(updated_by_user_id, recipient_id, reason)) end -- cgit v1.2.3