Skip to content

Remove the `comment_personal_snippet` permission

Sean McGivern requested to merge remove-comment-personal-snippet-permission into master

What does this MR do?

In https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2794 we added create_note for consistency, but didn't complete the refactor as it was a security patch. This is now entirely handled by create_note:

  1. Project snippets prevent create_note.
  2. Uploads already only support routing for personal snippets.

This simplifies some policies and access checks, too!

Does this MR meet the acceptance criteria?

Conformity

Performance and testing

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/56688.

Merge request reports