diff options
| author | Stan Hu <stanhu@gmail.com> | 2017-02-04 00:14:17 -0800 |
|---|---|---|
| committer | Rémy Coutable <remy@rymai.me> | 2017-02-20 17:19:11 +0100 |
| commit | e23c803769955d6728ed048112f8ca21e9b58a47 (patch) | |
| tree | 9e184ee7f60d891cc9be7e2f561d5189c4942192 /changelogs/unreleased | |
| parent | fbbbf1e4e77768a40b835455f17749384f7c4984 (diff) | |
| download | gitlab-ce-e23c803769955d6728ed048112f8ca21e9b58a47.tar.gz | |
Add user deletion permission check in `Users::DestroyService`sh-delete-user-permission-check
We saw from a recent incident that the `Users::DestroyService` would
attempt to delete a user over and over. Revoking the permissions
from the current user did not help. We should ensure that the
current user does, in fact, have permissions to delete the user.
Signed-off-by: Rémy Coutable <remy@rymai.me>
Diffstat (limited to 'changelogs/unreleased')
| -rw-r--r-- | changelogs/unreleased/sh-delete-user-permission-check.yml | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/changelogs/unreleased/sh-delete-user-permission-check.yml b/changelogs/unreleased/sh-delete-user-permission-check.yml new file mode 100644 index 00000000000..c0e79aae2a8 --- /dev/null +++ b/changelogs/unreleased/sh-delete-user-permission-check.yml @@ -0,0 +1,4 @@ +--- +title: Add user deletion permission check in `Users::DestroyService` +merge_request: +author: |