Fix: user could steal specific runner

- check if user has manage access to project
- don't cache result of authorized_projects, because it's serialised with User object
- clear user sessions

1 files changed, 4 insertions, 1 deletions

diff --git a/app/models/user.rb b/app/models/user.rb
index 138e5e4..1523577 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -71,7 +71,10 @@ class User
   end
 
   def authorized_projects
-    @authorized_projects ||= Project.where(gitlab_id: gitlab_projects.map(&:id))
+    Project.where(gitlab_id: gitlab_projects.map(&:id)).select do |project|
+      # This is slow: it makes request to GitLab for each project to verify manage permission
+      can_manage_project?(project.gitlab_id)
+    end
   end
 
   private