diff options
| author | Stan Hu <stanhu@gmail.com> | 2019-08-28 21:57:54 -0700 |
|---|---|---|
| committer | Stan Hu <stanhu@gmail.com> | 2019-08-29 12:54:19 -0700 |
| commit | f6c7e38040492db018943e537e30a7dd10e46120 (patch) | |
| tree | af6f64104403475d080c5a867e5dee715e4520d1 /app/views/shared/issuable/_form.html.haml | |
| parent | f7e3693435307b56e4da8d8584c6af01459e4813 (diff) | |
| download | gitlab-ce-f6c7e38040492db018943e537e30a7dd10e46120.tar.gz | |
Make it harder to delete issuables accidentally
Previously submitting a DELETE request to an issuable URL would be
enough to destroy it, but this should require human confirmation. We
now require that the `destroy_confirm` parameter is set to a truthy
value before this can complete.
In addition, we log a Sentry error if a deletion arrived without
confirmation.
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/62387
Diffstat (limited to 'app/views/shared/issuable/_form.html.haml')
| -rw-r--r-- | app/views/shared/issuable/_form.html.haml | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/views/shared/issuable/_form.html.haml b/app/views/shared/issuable/_form.html.haml index 214e87052da..04a70e406ca 100644 --- a/app/views/shared/issuable/_form.html.haml +++ b/app/views/shared/issuable/_form.html.haml @@ -66,7 +66,7 @@ = link_to 'Cancel', polymorphic_path([@project.namespace.becomes(Namespace), @project, issuable.class]), class: 'btn btn-cancel' - else - if can?(current_user, :"destroy_#{issuable.to_ability_name}", @project) - = link_to 'Delete', polymorphic_path([@project.namespace.becomes(Namespace), @project, issuable]), data: { confirm: "#{issuable.human_class_name} will be removed! Are you sure?" }, method: :delete, class: 'btn btn-danger btn-grouped' + = link_to 'Delete', polymorphic_path([@project.namespace.becomes(Namespace), @project, issuable], params: { destroy_confirm: true }), data: { confirm: "#{issuable.human_class_name} will be removed! Are you sure?" }, method: :delete, class: 'btn btn-danger btn-grouped' = link_to 'Cancel', polymorphic_path([@project.namespace.becomes(Namespace), @project, issuable]), class: 'btn btn-grouped btn-cancel' %span.append-right-10 |