diff options
| author | Rémy Coutable <remy@rymai.me> | 2017-08-16 11:25:26 +0000 |
|---|---|---|
| committer | Rémy Coutable <remy@rymai.me> | 2017-08-16 11:25:26 +0000 |
| commit | fcce6c3168dbd04404f318b4e983d7395d21538c (patch) | |
| tree | d8155d729f0915f6117bbe1f4010fffec9d37e56 /lib/api/v3 | |
| parent | 9ac2a517798af2f942b28138403690afc20a254c (diff) | |
| parent | 260c8da060a6039cbd47cfe31c8ec6d6f9b43de0 (diff) | |
| download | gitlab-ce-fcce6c3168dbd04404f318b4e983d7395d21538c.tar.gz | |
Merge branch 'rs-more-public-send-whitelists' into 'master'
Whitelist or fix additional `Gitlab/PublicSend` cop violations
See merge request !13467
Diffstat (limited to 'lib/api/v3')
| -rw-r--r-- | lib/api/v3/notes.rb | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/lib/api/v3/notes.rb b/lib/api/v3/notes.rb index 23fe95e42e4..d49772b92f2 100644 --- a/lib/api/v3/notes.rb +++ b/lib/api/v3/notes.rb @@ -22,7 +22,7 @@ module API use :pagination end get ":id/#{noteables_str}/:noteable_id/notes" do - noteable = user_project.send(noteables_str.to_sym).find(params[:noteable_id]) + noteable = user_project.public_send(noteables_str.to_sym).find(params[:noteable_id]) # rubocop:disable GitlabSecurity/PublicSend if can?(current_user, noteable_read_ability_name(noteable), noteable) # We exclude notes that are cross-references and that cannot be viewed @@ -50,7 +50,7 @@ module API requires :noteable_id, type: Integer, desc: 'The ID of the noteable' end get ":id/#{noteables_str}/:noteable_id/notes/:note_id" do - noteable = user_project.send(noteables_str.to_sym).find(params[:noteable_id]) + noteable = user_project.public_send(noteables_str.to_sym).find(params[:noteable_id]) # rubocop:disable GitlabSecurity/PublicSend note = noteable.notes.find(params[:note_id]) can_read_note = can?(current_user, noteable_read_ability_name(noteable), noteable) && !note.cross_reference_not_visible_for?(current_user) @@ -76,7 +76,7 @@ module API noteable_id: params[:noteable_id] } - noteable = user_project.send(noteables_str.to_sym).find(params[:noteable_id]) + noteable = user_project.public_send(noteables_str.to_sym).find(params[:noteable_id]) # rubocop:disable GitlabSecurity/PublicSend if can?(current_user, noteable_read_ability_name(noteable), noteable) if params[:created_at] && (current_user.admin? || user_project.owner == current_user) |