diff options
| author | Douwe Maan <douwe@gitlab.com> | 2015-08-21 09:47:39 -0700 |
|---|---|---|
| committer | Robert Speicher <rspeicher@gmail.com> | 2015-08-21 11:03:23 -0700 |
| commit | 4ed89992f3d98077c2c78afc5ced9c7007751f06 (patch) | |
| tree | 55b1a4baadac30c218e19e51f532ec373dd1babd | |
| parent | db4d828e754ab3692ba0abd920061e1537686eb2 (diff) | |
| download | gitlab-ce-4ed89992f3d98077c2c78afc5ced9c7007751f06.tar.gz | |
Check permissions on target project in merge request create service.
| -rw-r--r-- | app/services/merge_requests/create_service.rb | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/app/services/merge_requests/create_service.rb b/app/services/merge_requests/create_service.rb index f431c5d5534..9651b16462c 100644 --- a/app/services/merge_requests/create_service.rb +++ b/app/services/merge_requests/create_service.rb @@ -1,11 +1,17 @@ module MergeRequests class CreateService < MergeRequests::BaseService def execute + # @project is used to determine whether the user can set the merge request's + # assignee, milestone and labels. Whether they can depends on their + # permissions on the target project. + source_project = @project + @project = Project.find(params[:target_project_id]) if params[:target_project_id] + filter_params label_params = params[:label_ids] merge_request = MergeRequest.new(params.except(:label_ids)) - merge_request.source_project = project - merge_request.target_project ||= project + merge_request.source_project = source_project + merge_request.target_project ||= source_project merge_request.author = current_user if merge_request.save |