From 3ddd9f753c0a6a57313ea4860bf7167f98f53cd2 Mon Sep 17 00:00:00 2001 From: Dmitriy Zaporozhets Date: Fri, 25 Jan 2013 15:42:41 +0200 Subject: Fix mass-assignment. Dont allow users w/o access to create team --- app/controllers/application_controller.rb | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'app/controllers/application_controller.rb') diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index f903c7fdd62..74125e3308a 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -94,6 +94,10 @@ class ApplicationController < ActionController::Base return access_denied! unless can?(current_user, :download_code, project) end + def authorize_create_team! + return access_denied! unless can?(current_user, :create_team, nil) + end + def authorize_manage_user_team! return access_denied! unless user_team.present? && can?(current_user, :manage_user_team, user_team) end -- cgit v1.2.1