diff options
| author | GitLab Bot <gitlab-bot@gitlab.com> | 2022-07-27 19:06:07 +0000 |
|---|---|---|
| committer | GitLab Bot <gitlab-bot@gitlab.com> | 2022-07-27 19:06:32 +0000 |
| commit | 62e0c3c7d73f028e4c6c8c179d6f04f811a0859f (patch) | |
| tree | 69d0c42cb329dd5c64997243608e745dcef77c38 /app/controllers | |
| parent | bbcd372db175c8f19b4b72453ff57c9a19887c5f (diff) | |
| download | gitlab-ce-62e0c3c7d73f028e4c6c8c179d6f04f811a0859f.tar.gz | |
Add latest changes from gitlab-org/security/gitlab@15-2-stable-ee
Diffstat (limited to 'app/controllers')
| -rw-r--r-- | app/controllers/autocomplete_controller.rb | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/app/controllers/autocomplete_controller.rb b/app/controllers/autocomplete_controller.rb index 32d1ddf920e..6d1ffc1f2e8 100644 --- a/app/controllers/autocomplete_controller.rb +++ b/app/controllers/autocomplete_controller.rb @@ -5,6 +5,7 @@ class AutocompleteController < ApplicationController skip_before_action :authenticate_user!, only: [:users, :award_emojis, :merge_request_target_branches] before_action :check_search_rate_limit!, only: [:users, :projects] + before_action :authorize_admin_project, only: :deploy_keys_with_owners feature_category :users, [:users, :user] feature_category :projects, [:projects] @@ -69,6 +70,10 @@ class AutocompleteController < ApplicationController private + def authorize_admin_project + render_403 unless Ability.allowed?(current_user, :admin_project, project) + end + def project @project ||= Autocomplete::ProjectFinder .new(current_user, params) |