From 43830eca33b6be5d59685be5c2f3270ed81bf751 Mon Sep 17 00:00:00 2001 From: Felipe Artur Date: Wed, 10 Jul 2019 17:04:02 -0300 Subject: Do not show moved issue ids for user not authorized Do not show moved issue id for users that cannot read issue --- app/serializers/issue_entity.rb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'app/serializers/issue_entity.rb') diff --git a/app/serializers/issue_entity.rb b/app/serializers/issue_entity.rb index 36e601f45c5..82139855760 100644 --- a/app/serializers/issue_entity.rb +++ b/app/serializers/issue_entity.rb @@ -16,9 +16,14 @@ class IssueEntity < IssuableEntity expose :discussion_locked expose :assignees, using: API::Entities::UserBasic expose :due_date - expose :moved_to_id expose :project_id + expose :moved_to_id do |issue| + if issue.moved_to_id.present? && can?(request.current_user, :read_issue, issue.moved_to) + issue.moved_to_id + end + end + expose :web_url do |issue| project_issue_path(issue.project, issue) end -- cgit v1.2.3