diff options
| author | Felipe Artur <felipefac@gmail.com> | 2019-08-08 16:29:45 -0300 |
|---|---|---|
| committer | Felipe Artur <felipefac@gmail.com> | 2019-08-21 11:42:35 -0300 |
| commit | d9fe1589bc03872521c5e31df1de8cbfbc51df42 (patch) | |
| tree | 625eb6e2444efa199886e9022a495ec3e516903b /app | |
| parent | 4a6d22ba439cb20937669c4aa2046acffb36a60e (diff) | |
| download | gitlab-ce-d9fe1589bc03872521c5e31df1de8cbfbc51df42.tar.gz | |
Prevent disclosure of merge request id via email
Do not disclosure merge request id via email for unauthorized users
when closing issues.
Diffstat (limited to 'app')
| -rw-r--r-- | app/helpers/emails_helper.rb | 4 | ||||
| -rw-r--r-- | app/mailers/emails/issues.rb | 2 |
2 files changed, 6 insertions, 0 deletions
diff --git a/app/helpers/emails_helper.rb b/app/helpers/emails_helper.rb index 36122d3a22a..23596769738 100644 --- a/app/helpers/emails_helper.rb +++ b/app/helpers/emails_helper.rb @@ -90,6 +90,8 @@ module EmailsHelper when MergeRequest merge_request = MergeRequest.find(closed_via[:id]).present + return "" unless Ability.allowed?(@recipient, :read_merge_request, merge_request) + case format when :html merge_request_link = link_to(merge_request.to_reference, merge_request.web_url) @@ -102,6 +104,8 @@ module EmailsHelper # Technically speaking this should be Commit but per # https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/15610#note_163812339 # we can't deserialize Commit without custom serializer for ActiveJob + return "" unless Ability.allowed?(@recipient, :download_code, @project) + _("via %{closed_via}") % { closed_via: closed_via } else "" diff --git a/app/mailers/emails/issues.rb b/app/mailers/emails/issues.rb index f3a3203f7ad..0bba2a8bf24 100644 --- a/app/mailers/emails/issues.rb +++ b/app/mailers/emails/issues.rb @@ -34,6 +34,8 @@ module Emails setup_issue_mail(issue_id, recipient_id, closed_via: closed_via) @updated_by = User.find(updated_by_user_id) + @recipient = User.find(recipient_id) + mail_answer_thread(@issue, issue_thread_options(updated_by_user_id, recipient_id, reason)) end |