Many endpoints use `project.{issues,merge_request}.{where,find}` without checking current user access to that feature
All of these should be using the {Issues,MergeRequest}Finder
instead of project.{issues,merge_request}
. Also prefer the finder over an explicit can?(current_user, :read_{issue,merge_request}, issuable)
check, instead of in the IssuesController
or MergeRequestController
that have a before_action :authorize_read_{issue,merge_request}!
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/controllers/projects/branches_controller.rb#L39
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/services/merge_requests/build_service.rb#L68
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/finders/notes_finder.rb#L15
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/finders/notes_finder.rb#L17
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/models/cycle_analytics/summary.rb#L9
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/views/layouts/nav/_project.html.haml#L73
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/views/layouts/nav/_project.html.haml#L80
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/controllers/concerns/creates_commit.rb#L84
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/controllers/projects/commits_controller.rb#L24
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/controllers/projects/compare_controller.rb#L56
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/controllers/projects/discussions_controller.rb#L29
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/controllers/projects/todos_controller.rb#L19
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/controllers/projects/todos_controller.rb#L27
- http://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/models/commit.rb#L268
Added in the MR
- app/models/concerns/milestoneish.rb:27
- app/models/note.rb:121
- lib/api/issues.rb:112 -> Discloses issuses which should be visible to
Only team members
- lib/api/helpers.rb:126
- lib/gitlab/search_results.rb:53
- see MR for more
/cc @felipe_artur