From d7cccb194162ef9f7881973bdfe9f1ebf24d880a Mon Sep 17 00:00:00 2001 From: Alexandru Croitor Date: Fri, 6 Sep 2019 21:46:51 +0300 Subject: Display only participants that user has permission to see --- app/controllers/concerns/milestone_actions.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'app') diff --git a/app/controllers/concerns/milestone_actions.rb b/app/controllers/concerns/milestone_actions.rb index 8b8b7db72f8..1ead631663e 100644 --- a/app/controllers/concerns/milestone_actions.rb +++ b/app/controllers/concerns/milestone_actions.rb @@ -20,7 +20,7 @@ module MilestoneActions format.html { redirect_to milestone_redirect_path } format.json do render json: tabs_json("shared/milestones/_participants_tab", { - users: @milestone.participants # rubocop:disable Gitlab/ModuleWithInstanceVariables + users: @milestone.issue_participants_visible_by_user(current_user) # rubocop:disable Gitlab/ModuleWithInstanceVariables }) end end -- cgit v1.2.3