diff options
| author | GitLab Bot <gitlab-bot@gitlab.com> | 2021-10-27 10:13:35 +0000 |
|---|---|---|
| committer | GitLab Bot <gitlab-bot@gitlab.com> | 2021-10-27 10:13:35 +0000 |
| commit | e8ae58a7c189407375b3f575b7aa8fb17a1e4f99 (patch) | |
| tree | 027bb4d3f911b7a07c7552f142d9b3fad32e9318 /app | |
| parent | 51b27ab58055b65e14e68b19604e4823389adb73 (diff) | |
| download | gitlab-ce-e8ae58a7c189407375b3f575b7aa8fb17a1e4f99.tar.gz | |
Add latest changes from gitlab-org/security/gitlab@14-4-stable-ee
Diffstat (limited to 'app')
| -rw-r--r-- | app/graphql/mutations/issues/set_severity.rb | 2 | ||||
| -rw-r--r-- | app/services/issuable_base_service.rb | 1 |
2 files changed, 3 insertions, 0 deletions
diff --git a/app/graphql/mutations/issues/set_severity.rb b/app/graphql/mutations/issues/set_severity.rb index 778563ba053..872a0e7b33d 100644 --- a/app/graphql/mutations/issues/set_severity.rb +++ b/app/graphql/mutations/issues/set_severity.rb @@ -8,6 +8,8 @@ module Mutations argument :severity, Types::IssuableSeverityEnum, required: true, description: 'Set the incident severity level.' + authorize :admin_issue + def resolve(project_path:, iid:, severity:) issue = authorized_find!(project_path: project_path, iid: iid) project = issue.project diff --git a/app/services/issuable_base_service.rb b/app/services/issuable_base_service.rb index 59e521853de..2daf098b94a 100644 --- a/app/services/issuable_base_service.rb +++ b/app/services/issuable_base_service.rb @@ -142,6 +142,7 @@ class IssuableBaseService < ::BaseProjectService def filter_severity(issuable) severity = params.delete(:severity) return unless severity && issuable.supports_severity? + return unless can_admin_issuable?(issuable) severity = IssuableSeverity::DEFAULT unless IssuableSeverity.severities.key?(severity) return if severity == issuable.severity |