summaryrefslogtreecommitdiff
path: root/lib/api/notes.rb
diff options
context:
space:
mode:
authorFelipe Artur <felipefac@gmail.com>2016-05-16 16:43:19 -0300
committerFelipe Artur <felipefac@gmail.com>2016-05-16 16:43:19 -0300
commitc9be74e24797c1dab5b443728349bb0c5ce969c3 (patch)
tree97fbf1bbc482956f64047ef9f1e07611893c2407 /lib/api/notes.rb
parent93ca5c9964a26fbf31fcc794348b30193f4dff9f (diff)
downloadgitlab-ce-c9be74e24797c1dab5b443728349bb0c5ce969c3.tar.gz
Fix single note api request
Diffstat (limited to 'lib/api/notes.rb')
-rw-r--r--lib/api/notes.rb10
1 files changed, 5 insertions, 5 deletions
diff --git a/lib/api/notes.rb b/lib/api/notes.rb
index f0116acd90f..c49b107d1d9 100644
--- a/lib/api/notes.rb
+++ b/lib/api/notes.rb
@@ -20,9 +20,8 @@ module API
# GET /projects/:id/snippets/:noteable_id/notes
get ":id/#{noteables_str}/:#{noteable_id_str}/notes" do
@noteable = user_project.send(noteables_str.to_sym).find(params[noteable_id_str.to_sym])
- read_ability_name = "read_#{@noteable.class.to_s.underscore.downcase}".to_sym
- if can?(current_user, read_ability_name, @noteable)
+ if can?(current_user, noteable_ability_name(@noteable), @noteable)
# We exclude notes that are cross-references and that cannot be viewed
# by the current user. By doing this exclusion at this level and not
# at the DB query level (which we cannot in that case), the current
@@ -52,11 +51,12 @@ module API
get ":id/#{noteables_str}/:#{noteable_id_str}/notes/:note_id" do
@noteable = user_project.send(noteables_str.to_sym).find(params[noteable_id_str.to_sym])
@note = @noteable.notes.find(params[:note_id])
+ can_read_note = can?(current_user, noteable_ability_name(@noteable), @noteable) && !@note.cross_reference_not_visible_for?(current_user)
- if @note.cross_reference_not_visible_for?(current_user)
- not_found!("Note")
- else
+ if can_read_note
present @note, with: Entities::Note
+ else
+ not_found!("Note")
end
end