summaryrefslogtreecommitdiff
path: root/app
diff options
context:
space:
mode:
authorDouwe Maan <douwe@gitlab.com>2016-10-20 14:54:55 +0000
committerRémy Coutable <remy@rymai.me>2016-10-24 15:49:05 +0200
commit4a0e8f59e25a0b33e8e8cf33678688df912da8eb (patch)
tree3e85c7274cf56f34f591c6618c8ee9301a87e37f /app
parent0e43e34b45c6e1de68e65c8a51df078e850ec2c6 (diff)
downloadgitlab-ce-4a0e8f59e25a0b33e8e8cf33678688df912da8eb.tar.gz
Merge branch 'security-fix-leaking-namespace-name' into 'security'
Check that user has access to a given namespace to prevent leaking namespace names. See merge request !2009
Diffstat (limited to 'app')
-rw-r--r--app/controllers/import/gitlab_projects_controller.rb4
-rw-r--r--app/views/import/gitlab_projects/new.html.haml4
2 files changed, 4 insertions, 4 deletions
diff --git a/app/controllers/import/gitlab_projects_controller.rb b/app/controllers/import/gitlab_projects_controller.rb
index 3ec173abcdb..36d246d185b 100644
--- a/app/controllers/import/gitlab_projects_controller.rb
+++ b/app/controllers/import/gitlab_projects_controller.rb
@@ -2,8 +2,8 @@ class Import::GitlabProjectsController < Import::BaseController
before_action :verify_gitlab_project_import_enabled
def new
- @namespace_id = project_params[:namespace_id]
- @namespace_name = Namespace.find(project_params[:namespace_id]).name
+ @namespace = Namespace.find(project_params[:namespace_id])
+ return render_404 unless current_user.can?(:create_projects, @namespace)
@path = project_params[:path]
end
diff --git a/app/views/import/gitlab_projects/new.html.haml b/app/views/import/gitlab_projects/new.html.haml
index 44e2653ca4a..767dffb5589 100644
--- a/app/views/import/gitlab_projects/new.html.haml
+++ b/app/views/import/gitlab_projects/new.html.haml
@@ -9,12 +9,12 @@
%p
Project will be imported as
%strong
- #{@namespace_name}/#{@path}
+ #{@namespace.name}/#{@path}
%p
To move or copy an entire GitLab project from another GitLab installation to this one, navigate to the original project's settings page, generate an export file, and upload it here.
.form-group
- = hidden_field_tag :namespace_id, @namespace_id
+ = hidden_field_tag :namespace_id, @namespace.id
= hidden_field_tag :path, @path
= label_tag :file, class: 'control-label' do
%span GitLab project export