diff options
| author | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2015-06-25 16:17:48 +0200 |
|---|---|---|
| committer | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2015-06-25 16:17:48 +0200 |
| commit | 0bcfe9a0dcf630b166376bf05de966132d6ee45d (patch) | |
| tree | 276a415b4d3ddfca709af69bb3ff2d031adf453a | |
| parent | 5ff870a044150bef027b903bd944b8cc0578f798 (diff) | |
| download | gitlab-ce-0bcfe9a0dcf630b166376bf05de966132d6ee45d.tar.gz | |
Dont allow set assignee, milestone or labels if user is guest
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
| -rw-r--r-- | app/services/issuable_base_service.rb | 14 | ||||
| -rw-r--r-- | app/services/issues/create_service.rb | 1 | ||||
| -rw-r--r-- | app/services/issues/update_service.rb | 1 | ||||
| -rw-r--r-- | app/services/merge_requests/create_service.rb | 1 | ||||
| -rw-r--r-- | app/services/merge_requests/update_service.rb | 1 |
5 files changed, 18 insertions, 0 deletions
diff --git a/app/services/issuable_base_service.rb b/app/services/issuable_base_service.rb index 1d99223cfe6..cb544eaf89b 100644 --- a/app/services/issuable_base_service.rb +++ b/app/services/issuable_base_service.rb @@ -26,4 +26,18 @@ class IssuableBaseService < BaseService issuable, issuable.project, current_user, branch_type, old_branch, new_branch) end + + def filter_params + unless can?(current_user, :set_milestone, project) + params.delete(:milestone_id) + end + + unless can?(current_user, :set_label, project) + params.delete(:label_ids) + end + + unless can?(current_user, :set_assignee, project) + params.delete(:assignee_id) + end + end end diff --git a/app/services/issues/create_service.rb b/app/services/issues/create_service.rb index d5c17906a55..1ea4b72216c 100644 --- a/app/services/issues/create_service.rb +++ b/app/services/issues/create_service.rb @@ -1,6 +1,7 @@ module Issues class CreateService < Issues::BaseService def execute + filter_params label_params = params[:label_ids] issue = project.issues.new(params.except(:label_ids)) issue.author = current_user diff --git a/app/services/issues/update_service.rb b/app/services/issues/update_service.rb index 6af942a5ca4..3220facaf7c 100644 --- a/app/services/issues/update_service.rb +++ b/app/services/issues/update_service.rb @@ -17,6 +17,7 @@ module Issues params[:assignee_id] = "" if params[:assignee_id] == IssuableFinder::NONE params[:milestone_id] = "" if params[:milestone_id] == IssuableFinder::NONE + filter_params old_labels = issue.labels.to_a if params.present? && issue.update_attributes(params.except(:state_event, diff --git a/app/services/merge_requests/create_service.rb b/app/services/merge_requests/create_service.rb index ca8d80f6c0c..f431c5d5534 100644 --- a/app/services/merge_requests/create_service.rb +++ b/app/services/merge_requests/create_service.rb @@ -1,6 +1,7 @@ module MergeRequests class CreateService < MergeRequests::BaseService def execute + filter_params label_params = params[:label_ids] merge_request = MergeRequest.new(params.except(:label_ids)) merge_request.source_project = project diff --git a/app/services/merge_requests/update_service.rb b/app/services/merge_requests/update_service.rb index 4f6c6cba9a9..f6570f52241 100644 --- a/app/services/merge_requests/update_service.rb +++ b/app/services/merge_requests/update_service.rb @@ -27,6 +27,7 @@ module MergeRequests params[:assignee_id] = "" if params[:assignee_id] == IssuableFinder::NONE params[:milestone_id] = "" if params[:milestone_id] == IssuableFinder::NONE + filter_params old_labels = merge_request.labels.to_a if params.present? && merge_request.update_attributes( |