diff options
author | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2015-04-01 01:01:38 +0000 |
---|---|---|
committer | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2015-04-01 01:01:38 +0000 |
commit | dc3b4321ff6ed08b41a9155b85b12df0145df077 (patch) | |
tree | d2d99f1acd69de085c77df00302ba44954042d81 /app | |
parent | 0622b875370469c3596eb4cea200dc507fc01a30 (diff) | |
parent | a4608a8dbce1ba5b4c07a51f88d6a5fa60728dca (diff) | |
download | gitlab-ce-dc3b4321ff6ed08b41a9155b85b12df0145df077.tar.gz |
Merge branch 'group-information-leak' into 'master'
Don't leak private group existence by redirecting from namespace controller to group controller.
See merge request !440
Diffstat (limited to 'app')
-rw-r--r-- | app/controllers/namespaces_controller.rb | 18 | ||||
-rw-r--r-- | app/models/concerns/mentionable.rb | 2 |
2 files changed, 14 insertions, 6 deletions
diff --git a/app/controllers/namespaces_controller.rb b/app/controllers/namespaces_controller.rb index b7a9d8c1291..386d103ee5a 100644 --- a/app/controllers/namespaces_controller.rb +++ b/app/controllers/namespaces_controller.rb @@ -4,14 +4,22 @@ class NamespacesController < ApplicationController def show namespace = Namespace.find_by(path: params[:id]) - unless namespace - return render_404 + if namespace + if namespace.is_a?(Group) + group = namespace + else + user = namespace.owner + end end - if namespace.type == "Group" - redirect_to group_path(namespace) + if user + redirect_to user_path(user) + elsif group && can?(current_user, :read_group, group) + redirect_to group_path(group) + elsif current_user.nil? + authenticate_user! else - redirect_to user_path(namespace.owner) + render_404 end end end diff --git a/app/models/concerns/mentionable.rb b/app/models/concerns/mentionable.rb index 74900d4675d..d96e07034ec 100644 --- a/app/models/concerns/mentionable.rb +++ b/app/models/concerns/mentionable.rb @@ -52,7 +52,7 @@ module Mentionable if identifier == "all" users.push(*project.team.members.flatten) elsif namespace = Namespace.find_by(path: identifier) - if namespace.type == "Group" + if namespace.is_a?(Group) users.push(*namespace.users) else users << namespace.owner |