diff options
| author | DJ Mountney <dj@gitlab.com> | 2017-03-18 04:23:15 +0000 |
|---|---|---|
| committer | DJ Mountney <david@twkie.net> | 2017-03-20 18:54:17 -0700 |
| commit | 7be39a894b27c0c0e4fab52c2f8147f216376538 (patch) | |
| tree | 806b9552af5476d8a59d746e5260dade42e4237b /app | |
| parent | 83a0c39808b132e8759d75cc774e0724f56b17ab (diff) | |
| download | gitlab-ce-7be39a894b27c0c0e4fab52c2f8147f216376538.tar.gz | |
Merge branch 'render-json-leak' into 'security'
fix for render json include leaks
See merge request !2074
Diffstat (limited to 'app')
| -rw-r--r-- | app/controllers/projects/issues_controller.rb | 2 | ||||
| -rw-r--r-- | app/controllers/projects/merge_requests_controller.rb | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/app/controllers/projects/issues_controller.rb b/app/controllers/projects/issues_controller.rb index f2fee62ebd6..088f46457b6 100644 --- a/app/controllers/projects/issues_controller.rb +++ b/app/controllers/projects/issues_controller.rb @@ -146,7 +146,7 @@ class Projects::IssuesController < Projects::ApplicationController end format.json do - render json: @issue.to_json(include: { milestone: {}, assignee: { methods: :avatar_url }, labels: { methods: :text_color } }, methods: [:task_status, :task_status_short]) + render json: @issue.to_json(include: { milestone: {}, assignee: { only: [:name, :username], methods: [:avatar_url] }, labels: { methods: :text_color } }, methods: [:task_status, :task_status_short]) end end diff --git a/app/controllers/projects/merge_requests_controller.rb b/app/controllers/projects/merge_requests_controller.rb index 82f9b6e06db..677a8a1a73a 100644 --- a/app/controllers/projects/merge_requests_controller.rb +++ b/app/controllers/projects/merge_requests_controller.rb @@ -308,7 +308,7 @@ class Projects::MergeRequestsController < Projects::ApplicationController end format.json do - render json: @merge_request.to_json(include: { milestone: {}, assignee: { methods: :avatar_url }, labels: { methods: :text_color } }, methods: [:task_status, :task_status_short]) + render json: @merge_request.to_json(include: { milestone: {}, assignee: { only: [:name, :username], methods: [:avatar_url] }, labels: { methods: :text_color } }, methods: [:task_status, :task_status_short]) end end rescue ActiveRecord::StaleObjectError |