diff options
| author | Bob Van Landuyt <bob@gitlab.com> | 2017-04-18 16:27:11 +0200 |
|---|---|---|
| committer | Bob Van Landuyt <bob@gitlab.com> | 2017-05-01 11:14:24 +0200 |
| commit | e50f4bc066e4477e9c59708f978383b071dc2959 (patch) | |
| tree | 01a5380078da222c87b6ed91012b7274c74cc20d /lib/constraints | |
| parent | ab5f9027fb2a78f9c15b3f4d0fcd20ed998e5272 (diff) | |
| download | gitlab-ce-e50f4bc066e4477e9c59708f978383b071dc2959.tar.gz | |
The dynamic path validator can block out partial paths
So we can block `objects` only when it is contained in `info/lfs` or `gitlab-lfs`
Diffstat (limited to 'lib/constraints')
| -rw-r--r-- | lib/constraints/group_url_constrainer.rb | 2 | ||||
| -rw-r--r-- | lib/constraints/project_url_constrainer.rb | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/lib/constraints/group_url_constrainer.rb b/lib/constraints/group_url_constrainer.rb index 48a33690cb2..1501f64d537 100644 --- a/lib/constraints/group_url_constrainer.rb +++ b/lib/constraints/group_url_constrainer.rb @@ -2,7 +2,7 @@ class GroupUrlConstrainer def matches?(request) id = request.params[:id] - return false unless DynamicPathValidator.valid_full_path?(id) + return false unless DynamicPathValidator.valid?(id) Group.find_by_full_path(id).present? end diff --git a/lib/constraints/project_url_constrainer.rb b/lib/constraints/project_url_constrainer.rb index 72c457d0369..064e1bd78e3 100644 --- a/lib/constraints/project_url_constrainer.rb +++ b/lib/constraints/project_url_constrainer.rb @@ -4,7 +4,7 @@ class ProjectUrlConstrainer project_path = request.params[:project_id] || request.params[:id] full_path = namespace_path + '/' + project_path - unless DynamicPathValidator.valid_full_path?(full_path) + unless DynamicPathValidator.valid?(full_path) return false end |