diff options
| author | Luke Duncalfe <lduncalfe@eml.cc> | 2019-01-31 17:21:35 +1300 |
|---|---|---|
| committer | Luke Duncalfe <lduncalfe@eml.cc> | 2019-02-18 11:30:32 +1300 |
| commit | 618b87448e9167f39d8216d1100733cc0fbf020b (patch) | |
| tree | 9e2a063df6a0b1df78e9d3487a6ed344f27b567a /lib/api/entities.rb | |
| parent | 813df901e81257e3175015c94022151824682e83 (diff) | |
| download | gitlab-ce-618b87448e9167f39d8216d1100733cc0fbf020b.tar.gz | |
Prevent leaking of private repo data through API
default_branch, statistics and config_ci_path are now only exposed if
the user has permissions to the repository.
Diffstat (limited to 'lib/api/entities.rb')
| -rw-r--r-- | lib/api/entities.rb | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/lib/api/entities.rb b/lib/api/entities.rb index 27da2c2e5ed..46cd4841e2d 100644 --- a/lib/api/entities.rb +++ b/lib/api/entities.rb @@ -156,7 +156,7 @@ module API class BasicProjectDetails < ProjectIdentity include ::API::ProjectsRelationBuilder - expose :default_branch + expose :default_branch, if: -> (project, options) { Ability.allowed?(options[:current_user], :download_code, project) } # Avoids an N+1 query: https://github.com/mbleigh/acts-as-taggable-on/issues/91#issuecomment-168273770 expose :tag_list do |project| # project.tags.order(:name).pluck(:name) is the most suitable option @@ -261,7 +261,7 @@ module API expose :open_issues_count, if: lambda { |project, options| project.feature_available?(:issues, options[:current_user]) } expose :runners_token, if: lambda { |_project, options| options[:user_can_admin_project] } expose :public_builds, as: :public_jobs - expose :ci_config_path + expose :ci_config_path, if: -> (project, options) { Ability.allowed?(options[:current_user], :download_code, project) } expose :shared_with_groups do |project, options| SharedGroup.represent(project.project_group_links, options) end @@ -270,8 +270,9 @@ module API expose :only_allow_merge_if_all_discussions_are_resolved expose :printing_merge_request_link_enabled expose :merge_method - - expose :statistics, using: 'API::Entities::ProjectStatistics', if: :statistics + expose :statistics, using: 'API::Entities::ProjectStatistics', if: -> (project, options) { + options[:statistics] && Ability.allowed?(options[:current_user], :download_code, project) + } # rubocop: disable CodeReuse/ActiveRecord def self.preload_relation(projects_relation, options = {}) |