diff options
| author | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2013-01-25 15:42:41 +0200 |
|---|---|---|
| committer | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2013-01-25 15:42:41 +0200 |
| commit | 3ddd9f753c0a6a57313ea4860bf7167f98f53cd2 (patch) | |
| tree | a6cef7e57fde4fedcc4ced7710a1631198a2f7b0 /app/controllers/teams_controller.rb | |
| parent | 70e05801b196a460ec2b1d6f6f096f44d32b7928 (diff) | |
| download | gitlab-ce-3ddd9f753c0a6a57313ea4860bf7167f98f53cd2.tar.gz | |
Fix mass-assignment. Dont allow users w/o access to create team
Diffstat (limited to 'app/controllers/teams_controller.rb')
| -rw-r--r-- | app/controllers/teams_controller.rb | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/app/controllers/teams_controller.rb b/app/controllers/teams_controller.rb index 7de094214d4..828bdeb80ab 100644 --- a/app/controllers/teams_controller.rb +++ b/app/controllers/teams_controller.rb @@ -1,13 +1,10 @@ class TeamsController < ApplicationController # Authorize - before_filter :authorize_manage_user_team! - before_filter :authorize_admin_user_team! + before_filter :authorize_create_team!, only: [:new, :create] + before_filter :authorize_manage_user_team!, only: [:edit, :update] + before_filter :authorize_admin_user_team!, only: [:destroy] - # Skip access control on public section - skip_before_filter :authorize_manage_user_team!, only: [:index, :show, :new, :destroy, :create, :search, :issues, :merge_requests] - skip_before_filter :authorize_admin_user_team!, only: [:index, :show, :new, :create, :search, :issues, :merge_requests] - - layout 'user_team', only: [:show, :edit, :update, :destroy, :issues, :merge_requests, :search] + layout 'user_team', except: [:new, :create] def index @teams = current_user.user_teams.order('name ASC') |