diff options
| author | Lin Jen-Shin <godfat@godfat.org> | 2016-06-14 22:58:38 +0800 |
|---|---|---|
| committer | Lin Jen-Shin <godfat@godfat.org> | 2016-06-14 22:58:38 +0800 |
| commit | 1b8f52d9206bdf19c0dde04505c4c0b1cf46cfbe (patch) | |
| tree | 51c00d356df437f2120312f1770806b5c45ac929 /app/controllers | |
| parent | cbd6ca6985c1a7eefcfa5b3ca170fdf1865aee45 (diff) | |
| download | gitlab-ce-1b8f52d9206bdf19c0dde04505c4c0b1cf46cfbe.tar.gz | |
Avoid enabling locked runners. Give 403 in this case
Diffstat (limited to 'app/controllers')
| -rw-r--r-- | app/controllers/admin/runner_projects_controller.rb | 2 | ||||
| -rw-r--r-- | app/controllers/projects/runner_projects_controller.rb | 1 |
2 files changed, 3 insertions, 0 deletions
diff --git a/app/controllers/admin/runner_projects_controller.rb b/app/controllers/admin/runner_projects_controller.rb index d25619d94e0..29307aeab6d 100644 --- a/app/controllers/admin/runner_projects_controller.rb +++ b/app/controllers/admin/runner_projects_controller.rb @@ -9,6 +9,8 @@ class Admin::RunnerProjectsController < Admin::ApplicationController def create @runner = Ci::Runner.find(params[:runner_project][:runner_id]) + return head(403) if runner.is_shared? || runner.is_locked? + if @runner.assign_to(@project, current_user) redirect_to admin_runner_path(@runner) else diff --git a/app/controllers/projects/runner_projects_controller.rb b/app/controllers/projects/runner_projects_controller.rb index bedeb4a295c..4c013303269 100644 --- a/app/controllers/projects/runner_projects_controller.rb +++ b/app/controllers/projects/runner_projects_controller.rb @@ -6,6 +6,7 @@ class Projects::RunnerProjectsController < Projects::ApplicationController def create @runner = Ci::Runner.find(params[:runner_project][:runner_id]) + return head(403) if runner.is_shared? || runner.is_locked? return head(403) unless current_user.ci_authorized_runners.include?(@runner) path = runners_path(project) |