summaryrefslogtreecommitdiff
path: root/lib/api/notes.rb
diff options
context:
space:
mode:
authorRémy Coutable <remy@rymai.me>2016-01-13 19:42:36 +0100
committerRémy Coutable <remy@rymai.me>2016-01-13 19:42:36 +0100
commit0c10aee59677e2dadfef6538a74fe1e28fcdd37e (patch)
tree6bc250845daa18f218e61881f50d6c3c2b37a1ff /lib/api/notes.rb
parent1f0b8c32e75b446848cead98c550e750801be534 (diff)
downloadgitlab-ce-0c10aee59677e2dadfef6538a74fe1e28fcdd37e.tar.gz
Ensure the API doesn't return notes that the current user shouldn't see
Diffstat (limited to 'lib/api/notes.rb')
-rw-r--r--lib/api/notes.rb21
1 files changed, 19 insertions, 2 deletions
diff --git a/lib/api/notes.rb b/lib/api/notes.rb
index 3efdfe2d46e..174473f5371 100644
--- a/lib/api/notes.rb
+++ b/lib/api/notes.rb
@@ -20,7 +20,19 @@ module API
# GET /projects/:id/snippets/:noteable_id/notes
get ":id/#{noteables_str}/:#{noteable_id_str}/notes" do
@noteable = user_project.send(:"#{noteables_str}").find(params[:"#{noteable_id_str}"])
- present paginate(@noteable.notes), with: Entities::Note
+
+ # We exclude notes that are cross-references and that cannot be viewed
+ # by the current user. By doing this exclusion at this level and not
+ # at the DB query level (which we cannot in that case), the current
+ # page can have less elements than :per_page even if
+ # there's more than one page.
+ notes =
+ # paginate() only works with a relation. This could lead to a
+ # mismatch between the pagination headers info and the actual notes
+ # array returned, but this is really a edge-case.
+ paginate(@noteable.notes).
+ reject { |n| n.cross_reference_not_visible_for?(current_user) }
+ present notes, with: Entities::Note
end
# Get a single +noteable+ note
@@ -35,7 +47,12 @@ module API
get ":id/#{noteables_str}/:#{noteable_id_str}/notes/:note_id" do
@noteable = user_project.send(:"#{noteables_str}").find(params[:"#{noteable_id_str}"])
@note = @noteable.notes.find(params[:note_id])
- present @note, with: Entities::Note
+
+ if @note.cross_reference_not_visible_for?(current_user)
+ not_found!("Note")
+ else
+ present @note, with: Entities::Note
+ end
end
# Create a new +noteable+ note