diff options
| author | Marin Jankovski <marin@gitlab.com> | 2019-07-02 06:23:28 +0000 |
|---|---|---|
| committer | Marin Jankovski <marin@gitlab.com> | 2019-07-02 06:23:28 +0000 |
| commit | fa77293bdca13d056dc7214583c3a0b370d18531 (patch) | |
| tree | 85b973f49e50dbbf241dc7e954c46c5b6ec9ba86 /lib/api | |
| parent | 108a6e4f3abb17b58903979ad1c2fc95d8715b85 (diff) | |
| parent | 4b8097c79ef5a891f5daac6f53af41b41209720e (diff) | |
| download | gitlab-ce-fa77293bdca13d056dc7214583c3a0b370d18531.tar.gz | |
Merge branch 'security-mr-head-pipeline-leak' into 'master'
[master] Fix MR head pipeline leak
See merge request gitlab/gitlabhq!3148
Diffstat (limited to 'lib/api')
| -rw-r--r-- | lib/api/entities.rb | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/api/entities.rb b/lib/api/entities.rb index 0f4332506a7..ac1dfb64a73 100644 --- a/lib/api/entities.rb +++ b/lib/api/entities.rb @@ -757,7 +757,9 @@ module API merge_request.metrics&.pipeline end - expose :head_pipeline, using: 'API::Entities::Pipeline' + expose :head_pipeline, using: 'API::Entities::Pipeline', if: -> (_, options) do + Ability.allowed?(options[:current_user], :read_pipeline, options[:project]) + end expose :diff_refs, using: Entities::DiffRefs |