From 0bcfe9a0dcf630b166376bf05de966132d6ee45d Mon Sep 17 00:00:00 2001 From: Dmitriy Zaporozhets Date: Thu, 25 Jun 2015 16:17:48 +0200 Subject: Dont allow set assignee, milestone or labels if user is guest Signed-off-by: Dmitriy Zaporozhets --- app/services/issuable_base_service.rb | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'app/services/issuable_base_service.rb') diff --git a/app/services/issuable_base_service.rb b/app/services/issuable_base_service.rb index 1d99223cfe6..cb544eaf89b 100644 --- a/app/services/issuable_base_service.rb +++ b/app/services/issuable_base_service.rb @@ -26,4 +26,18 @@ class IssuableBaseService < BaseService issuable, issuable.project, current_user, branch_type, old_branch, new_branch) end + + def filter_params + unless can?(current_user, :set_milestone, project) + params.delete(:milestone_id) + end + + unless can?(current_user, :set_label, project) + params.delete(:label_ids) + end + + unless can?(current_user, :set_assignee, project) + params.delete(:assignee_id) + end + end end -- cgit v1.2.3