From 654565c9dc734a597c525a75c8f72dd63235604b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9my=20Coutable?= Date: Fri, 17 Jun 2016 18:59:33 +0200 Subject: Raise a new Gitlab::Access::AccessDeniedError when permission is not enough to destroy a member MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This is a try for a new approach to put the access checks at the service level. Signed-off-by: Rémy Coutable --- app/services/members/destroy_service.rb | 26 ++++++-------------------- 1 file changed, 6 insertions(+), 20 deletions(-) (limited to 'app/services/members') diff --git a/app/services/members/destroy_service.rb b/app/services/members/destroy_service.rb index 59a55e42e38..15358f80208 100644 --- a/app/services/members/destroy_service.rb +++ b/app/services/members/destroy_service.rb @@ -7,29 +7,15 @@ module Members end def execute - if can?(current_user, "destroy_#{member.type.underscore}".to_sym, member) - member.destroy - - if member.request? && member.user != current_user - notification_service.decline_access_request(member) - end + unless member && can?(current_user, "destroy_#{member.type.underscore}".to_sym, member) + raise Gitlab::Access::AccessDeniedError end - member - end - - private - - def abilities - Ability.abilities - end - - def can?(object, action, subject) - abilities.allowed?(object, action, subject) - end + member.destroy - def notification_service - NotificationService.new + if member.request? && member.user != current_user + notification_service.decline_access_request(member) + end end end end -- cgit v1.2.3