diff options
| author | Douwe Maan <douwe@gitlab.com> | 2016-11-07 17:09:22 +0000 |
|---|---|---|
| committer | Alejandro RodrÃguez <alejorro70@gmail.com> | 2016-11-28 21:25:18 -0300 |
| commit | 742cee756bf39d93fe5c7f207f8a54143ae6a384 (patch) | |
| tree | 4a90c2d792acb54d14fa2c45c10b64caf66b3be7 /app/views/projects/diffs | |
| parent | 3d7704ae5f62446b8b399c796c64d1f527666376 (diff) | |
| download | gitlab-ce-742cee756bf39d93fe5c7f207f8a54143ae6a384.tar.gz | |
Merge branch 'jej-22869' into 'security'
Fix information disclosure in `Projects::BlobController#update`
It was possible to discover private project names by modifying `from_merge_request`parameter in `Projects::BlobController#update`. This fixes that.
- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.md) entry added
- Tests
- [x] Added for this feature/bug
- [ ] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)
https://gitlab.com/gitlab-org/gitlab-ce/issues/22869
See merge request !2023
Diffstat (limited to 'app/views/projects/diffs')
| -rw-r--r-- | app/views/projects/diffs/_file.html.haml | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/views/projects/diffs/_file.html.haml b/app/views/projects/diffs/_file.html.haml index 120ba9ffcd2..6c33d80becd 100644 --- a/app/views/projects/diffs/_file.html.haml +++ b/app/views/projects/diffs/_file.html.haml @@ -9,7 +9,7 @@ = icon('comment') \ - if editable_diff?(diff_file) - - link_opts = @merge_request.id ? { from_merge_request_id: @merge_request.id } : {} + - link_opts = @merge_request.persisted? ? { from_merge_request_iid: @merge_request.iid } : {} = edit_blob_link(@merge_request.source_project, @merge_request.source_branch, diff_file.new_path, blob: blob, link_opts: link_opts) |