diff options
| author | Alessio Caiazza <acaiazza@gitlab.com> | 2019-02-08 16:11:37 +0000 |
|---|---|---|
| committer | Alessio Caiazza <acaiazza@gitlab.com> | 2019-02-08 16:39:15 +0000 |
| commit | d5c858cd4032b3bf37c6fbe47340ccea825503bc (patch) | |
| tree | 49df95b6ebb13ddf923007cbc47dd1e6253af11d /lib | |
| parent | a6794a2736e9df488d4d8b5b336fded0b58d7d26 (diff) | |
| download | gitlab-ce-d5c858cd4032b3bf37c6fbe47340ccea825503bc.tar.gz | |
Prevent Releases links API to leak tag existance
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/api/release/links.rb | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/lib/api/release/links.rb b/lib/api/release/links.rb index e3072684ef7..5d1b40e3bff 100644 --- a/lib/api/release/links.rb +++ b/lib/api/release/links.rb @@ -8,6 +8,8 @@ module API RELEASE_ENDPOINT_REQUIREMETS = API::NAMESPACE_OR_PROJECT_REQUIREMENTS .merge(tag_name: API::NO_SLASH_URL_PART_REGEX) + before { authorize! :read_release, user_project } + params do requires :id, type: String, desc: 'The ID of a project' end |