diff options
| author | Charlie Ablett <cablett@gitlab.com> | 2019-10-29 15:58:26 +0000 |
|---|---|---|
| committer | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-10-29 15:58:26 +0000 |
| commit | d40b79021dc1f1ad95e608e17cac69a4390c9cf9 (patch) | |
| tree | 2c5da480a8244ac146e5718dcc4e376fe08bdf18 /app/policies/commit_policy.rb | |
| parent | 771f3fb9aae6129f5e6209e2f77e996e4562f176 (diff) | |
| download | gitlab-ce-d40b79021dc1f1ad95e608e17cac69a4390c9cf9.tar.gz | |
Improper access control allows the attacker to comment in internal commit after they are no longer admin
Diffstat (limited to 'app/policies/commit_policy.rb')
| -rw-r--r-- | app/policies/commit_policy.rb | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/app/policies/commit_policy.rb b/app/policies/commit_policy.rb index 4d4f0ba9267..4b358c45ec2 100644 --- a/app/policies/commit_policy.rb +++ b/app/policies/commit_policy.rb @@ -4,4 +4,5 @@ class CommitPolicy < BasePolicy delegate { @subject.project } rule { can?(:download_code) }.enable :read_commit + rule { ~can?(:read_commit) }.prevent :create_note end |