mirror of
https://github.com/wahyd4/gitlabhq.git
synced 2026-08-20 18:16:45 +10:00
Douwe MaanandRémy Coutable
ae1e3fb81a
Check permissions when sharing project with group ## Summary Unprivileged user was able to share project with group he didn't have access to, and therefore gain partial access to that group, which opened possibilities for further actions like listing private projects in that group. See https://gitlab.com/gitlab-org/gitlab-ce/issues/15330 ## Fix This change introduces additional check for group read access. ## Further work We can think about preventing such problems in the future (this is quite common problem) by moving permissions checks to another layer of abstraction (TBD). Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15330 See merge request !1949 Signed-off-by: Rémy Coutable <remy@rymai.me>
26 lines
697 B
Ruby
26 lines
697 B
Ruby
class Projects::GroupLinksController < Projects::ApplicationController
|
|
layout 'project_settings'
|
|
before_action :authorize_admin_project!
|
|
|
|
def index
|
|
@group_links = project.project_group_links.all
|
|
end
|
|
|
|
def create
|
|
group = Group.find(params[:link_group_id])
|
|
return render_404 unless can?(current_user, :read_group, group)
|
|
|
|
project.project_group_links.create(
|
|
group: group, group_access: params[:link_group_access]
|
|
)
|
|
|
|
redirect_to namespace_project_group_links_path(project.namespace, project)
|
|
end
|
|
|
|
def destroy
|
|
project.project_group_links.find(params[:id]).destroy
|
|
|
|
redirect_to namespace_project_group_links_path(project.namespace, project)
|
|
end
|
|
end
|