summaryrefslogtreecommitdiff
path: root/app
diff options
context:
space:
mode:
authorGitLab Release Tools Bot <robert+release-tools@gitlab.com>2019-09-26 13:53:25 +0000
committerGitLab Release Tools Bot <robert+release-tools@gitlab.com>2019-09-26 13:53:25 +0000
commit9c86027ec0556f59cef63cfe352cd30fafeaa13b (patch)
tree108079ab39d6a574d48602e18e9482cae4e75284 /app
parentf15977b0458bbb43964cdb476b00cde01b94260f (diff)
parentd7cccb194162ef9f7881973bdfe9f1ebf24d880a (diff)
downloadgitlab-ce-9c86027ec0556f59cef63cfe352cd30fafeaa13b.tar.gz
Merge branch 'security-12717-fix-confidential-issue-assignee-visible-to-guests-12-3' into '12-3-stable'
Display only participants that user has permission to see See merge request gitlab/gitlabhq!3421
Diffstat (limited to 'app')
-rw-r--r--app/controllers/concerns/milestone_actions.rb2
1 files changed, 1 insertions, 1 deletions
diff --git a/app/controllers/concerns/milestone_actions.rb b/app/controllers/concerns/milestone_actions.rb
index 8b8b7db72f8..1ead631663e 100644
--- a/app/controllers/concerns/milestone_actions.rb
+++ b/app/controllers/concerns/milestone_actions.rb
@@ -20,7 +20,7 @@ module MilestoneActions
format.html { redirect_to milestone_redirect_path }
format.json do
render json: tabs_json("shared/milestones/_participants_tab", {
- users: @milestone.participants # rubocop:disable Gitlab/ModuleWithInstanceVariables
+ users: @milestone.issue_participants_visible_by_user(current_user) # rubocop:disable Gitlab/ModuleWithInstanceVariables
})
end
end