diff options
author | Nick Thomas <nick@gitlab.com> | 2019-11-19 16:17:35 +0000 |
---|---|---|
committer | Nick Thomas <nick@gitlab.com> | 2019-11-25 11:48:47 +0000 |
commit | 644d125b9adeb20c0a7dfcd3dee2db7b7c1b6f2e (patch) | |
tree | ee8997f3669991d2cacd672bcc01621d464cddcc /lib | |
parent | 4c442bdda212490c660a4c0acd82d03f60d72dc9 (diff) | |
download | gitlab-ce-644d125b9adeb20c0a7dfcd3dee2db7b7c1b6f2e.tar.gz |
Check permissions before showing a forked project's source
Diffstat (limited to 'lib')
-rw-r--r-- | lib/api/entities.rb | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/api/entities.rb b/lib/api/entities.rb index 9617f1a8acf..32a0fb9dd60 100644 --- a/lib/api/entities.rb +++ b/lib/api/entities.rb @@ -283,7 +283,9 @@ module API expose :shared_runners_enabled expose :lfs_enabled?, as: :lfs_enabled expose :creator_id - expose :forked_from_project, using: Entities::BasicProjectDetails, if: lambda { |project, options| project.forked? } + expose :forked_from_project, using: Entities::BasicProjectDetails, if: ->(project, options) do + project.forked? && Ability.allowed?(options[:current_user], :read_project, project.forked_from_project) + end expose :import_status expose :import_error, if: lambda { |_project, options| options[:user_can_admin_project] } do |project| |