From d29ea1fa13c730abfb9ee1f88ec703e29b234970 Mon Sep 17 00:00:00 2001 From: drew cimino Date: Tue, 13 Aug 2019 19:03:05 -0400 Subject: admin_group authorization for Groups::RunnersController - Use authorize_admin_group! instead of authorize_admin_pipeline! - Added role-based permission specs for Groups::RunnersController --- app/controllers/groups/runners_controller.rb | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'app/controllers') diff --git a/app/controllers/groups/runners_controller.rb b/app/controllers/groups/runners_controller.rb index f8e32451b02..af2b2cbd1fd 100644 --- a/app/controllers/groups/runners_controller.rb +++ b/app/controllers/groups/runners_controller.rb @@ -3,7 +3,7 @@ class Groups::RunnersController < Groups::ApplicationController # Proper policies should be implemented per # https://gitlab.com/gitlab-org/gitlab-ce/issues/45894 - before_action :authorize_admin_pipeline! + before_action :authorize_admin_group! before_action :runner, only: [:edit, :update, :destroy, :pause, :resume, :show] @@ -50,10 +50,6 @@ class Groups::RunnersController < Groups::ApplicationController @runner ||= @group.runners.find(params[:id]) end - def authorize_admin_pipeline! - return render_404 unless can?(current_user, :admin_pipeline, group) - end - def runner_params params.require(:runner).permit(Ci::Runner::FORM_EDITABLE) end -- cgit v1.2.1