summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--app/policies/project_policy.rb1
-rw-r--r--lib/api/issues.rb11
-rw-r--r--spec/policies/project_policy_spec.rb2
-rw-r--r--spec/support/shared_contexts/policies/project_policy_shared_context.rb2
4 files changed, 6 insertions, 10 deletions
diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb
index 3218c04b219..728a3040227 100644
--- a/app/policies/project_policy.rb
+++ b/app/policies/project_policy.rb
@@ -164,6 +164,7 @@ class ProjectPolicy < BasePolicy
enable :set_issue_iid
enable :set_issue_created_at
+ enable :set_issue_updated_at
enable :set_note_created_at
end
diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index 56960a2eb64..039ebf92187 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -252,14 +252,9 @@ module API
issue = user_project.issues.find_by!(iid: params.delete(:issue_iid))
authorize! :update_issue, issue
- # Setting updated_at only allowed for admins and owners as well
- if params[:updated_at].present?
- if current_user.admin? || user_project.owner == current_user || current_user.owned_groups.include?(user_project.owner)
- issue.system_note_timestamp = params[:updated_at]
- else
- params.delete(:updated_at)
- end
- end
+ # Setting updated_at is allowed only for admins and owners
+ params.delete(:updated_at) unless current_user.can?(:set_issue_updated_at, user_project)
+ issue.system_note_timestamp = params[:updated_at]
update_params = declared_params(include_missing: false).merge(request: request, api: true)
diff --git a/spec/policies/project_policy_spec.rb b/spec/policies/project_policy_spec.rb
index 8075fcade5f..ed0e82ef179 100644
--- a/spec/policies/project_policy_spec.rb
+++ b/spec/policies/project_policy_spec.rb
@@ -66,7 +66,7 @@ describe ProjectPolicy do
%i[
change_namespace change_visibility_level rename_project remove_project
archive_project remove_fork_project destroy_merge_request destroy_issue
- set_issue_iid set_issue_created_at set_note_created_at
+ set_issue_iid set_issue_created_at set_issue_updated_at set_note_created_at
]
end
diff --git a/spec/support/shared_contexts/policies/project_policy_shared_context.rb b/spec/support/shared_contexts/policies/project_policy_shared_context.rb
index 54d9f5b15f2..1aa40dcde3d 100644
--- a/spec/support/shared_contexts/policies/project_policy_shared_context.rb
+++ b/spec/support/shared_contexts/policies/project_policy_shared_context.rb
@@ -64,7 +64,7 @@ RSpec.shared_context 'ProjectPolicy context' do
%i[
change_namespace change_visibility_level rename_project remove_project
archive_project remove_fork_project destroy_merge_request destroy_issue
- set_issue_iid set_issue_created_at set_note_created_at
+ set_issue_iid set_issue_created_at set_issue_updated_at set_note_created_at
]
end