diff options
Diffstat (limited to 'lib/api')
| -rw-r--r-- | lib/api/helpers/notes_helpers.rb | 2 | ||||
| -rw-r--r-- | lib/api/issues.rb | 6 |
2 files changed, 4 insertions, 4 deletions
diff --git a/lib/api/helpers/notes_helpers.rb b/lib/api/helpers/notes_helpers.rb index e2984b08eca..7885e3fa1e1 100644 --- a/lib/api/helpers/notes_helpers.rb +++ b/lib/api/helpers/notes_helpers.rb @@ -94,7 +94,7 @@ module API if opts[:created_at] opts.delete(:created_at) unless - current_user.admin? || parent.owned_by?(current_user) + (current_user.admin? || user_project.owner == current_user || current_user.owned_groups.include?(user_project.owner)) end opts[:updated_at] = opts[:created_at] if opts[:created_at] diff --git a/lib/api/issues.rb b/lib/api/issues.rb index bda05d1795b..2d2250acaa2 100644 --- a/lib/api/issues.rb +++ b/lib/api/issues.rb @@ -173,7 +173,7 @@ module API authorize! :create_issue, user_project # Setting created_at time or iid only allowed for admins and project owners - unless current_user.admin? || user_project.owner == current_user + unless current_user.admin? || user_project.owner == current_user || current_user.owned_groups.include?(user_project.owner) params.delete(:created_at) params.delete(:iid) end @@ -216,8 +216,8 @@ module API issue = user_project.issues.find_by!(iid: params.delete(:issue_iid)) authorize! :update_issue, issue - # Setting created_at time only allowed for admins and project owners - unless current_user.admin? || user_project.owner == current_user + # Setting created_at time only allowed for admins and project/group owners + unless current_user.admin? || user_project.owner == current_user || current_user.owned_groups.include?(user_project.owner) params.delete(:updated_at) end |