diff options
| author | Florent Dubois <florent.dubois@devaddict.io> | 2017-12-06 12:07:08 +0100 |
|---|---|---|
| committer | Sean McGivern <sean@gitlab.com> | 2018-08-22 12:16:48 +0100 |
| commit | b63ed7cff664bc1ee0bf70912fffd4814f757079 (patch) | |
| tree | 241982a476e831b971121e66b47348dc370c0b34 /lib/api/issues.rb | |
| parent | 1c95c5ec867b31389b513bd09a9cadc5f3fb6836 (diff) | |
| download | gitlab-ce-b63ed7cff664bc1ee0bf70912fffd4814f757079.tar.gz | |
Allow date parameters on Issues and Notes API for group owners
- Allow `created_at` and `updated_at` parameters on Issues API
- Allow `created_at` on Issue Notes API
Closes gitlab-org/gitlab-ce#40059
Diffstat (limited to 'lib/api/issues.rb')
| -rw-r--r-- | lib/api/issues.rb | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/lib/api/issues.rb b/lib/api/issues.rb index bda05d1795b..2d2250acaa2 100644 --- a/lib/api/issues.rb +++ b/lib/api/issues.rb @@ -173,7 +173,7 @@ module API authorize! :create_issue, user_project # Setting created_at time or iid only allowed for admins and project owners - unless current_user.admin? || user_project.owner == current_user + unless current_user.admin? || user_project.owner == current_user || current_user.owned_groups.include?(user_project.owner) params.delete(:created_at) params.delete(:iid) end @@ -216,8 +216,8 @@ module API issue = user_project.issues.find_by!(iid: params.delete(:issue_iid)) authorize! :update_issue, issue - # Setting created_at time only allowed for admins and project owners - unless current_user.admin? || user_project.owner == current_user + # Setting created_at time only allowed for admins and project/group owners + unless current_user.admin? || user_project.owner == current_user || current_user.owned_groups.include?(user_project.owner) params.delete(:updated_at) end |