diff options
| author | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-07-26 13:40:52 +0000 |
|---|---|---|
| committer | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-07-26 13:40:52 +0000 |
| commit | 4b2d49b7285f7968e894c635321f878d77773bb8 (patch) | |
| tree | 48868da3656e4fcd86253bb5536f15dcc8757a5e /app/serializers | |
| parent | cfc327b0c0cd59bd1283eda752f452dd9cbd1729 (diff) | |
| parent | 43830eca33b6be5d59685be5c2f3270ed81bf751 (diff) | |
| download | gitlab-ce-4b2d49b7285f7968e894c635321f878d77773bb8.tar.gz | |
Merge branch 'security-hide_moved_issue_id' into 'master'
Do not show moved issue ids for user not authorized
Closes #2878
See merge request gitlab/gitlabhq!3230
Diffstat (limited to 'app/serializers')
| -rw-r--r-- | app/serializers/issue_entity.rb | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/app/serializers/issue_entity.rb b/app/serializers/issue_entity.rb index 36e601f45c5..82139855760 100644 --- a/app/serializers/issue_entity.rb +++ b/app/serializers/issue_entity.rb @@ -16,9 +16,14 @@ class IssueEntity < IssuableEntity expose :discussion_locked expose :assignees, using: API::Entities::UserBasic expose :due_date - expose :moved_to_id expose :project_id + expose :moved_to_id do |issue| + if issue.moved_to_id.present? && can?(request.current_user, :read_issue, issue.moved_to) + issue.moved_to_id + end + end + expose :web_url do |issue| project_issue_path(issue.project, issue) end |