diff options
| author | Robert Speicher <robert@gitlab.com> | 2016-04-25 20:30:11 +0000 |
|---|---|---|
| committer | Robert Speicher <rspeicher@gmail.com> | 2016-04-25 16:35:32 -0400 |
| commit | 5e3f9b6076eccb9ea74cf7b86085ecebfd0cdecb (patch) | |
| tree | 598ebde4008db5f07e7275988bcd34ff82811ebd /app | |
| parent | 09e56167775f90dd6bb94bff84132b327f98f176 (diff) | |
| download | gitlab-ce-5e3f9b6076eccb9ea74cf7b86085ecebfd0cdecb.tar.gz | |
Merge branch 'fix-private-snippet-api' into 'master'
Prevent information disclosure via snippet API
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15580
See merge request !1958
Diffstat (limited to 'app')
| -rw-r--r-- | app/finders/snippets_finder.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/app/finders/snippets_finder.rb b/app/finders/snippets_finder.rb index a41172816b8..01cbf91c658 100644 --- a/app/finders/snippets_finder.rb +++ b/app/finders/snippets_finder.rb @@ -51,7 +51,7 @@ class SnippetsFinder snippets = project.snippets.fresh if current_user - if project.team.member?(current_user.id) + if project.team.member?(current_user.id) || current_user.admin? snippets else snippets.public_and_internal |