Add a permission check in ProjectExportWorker to make sure user has sufficient permissions at export time
This is the 3rd vulnerability described at https://gitlab.com/gitlab-org/gitlab-ce/issues/67109
This is where the third vulnerability can be found. When an export job is scheduled, it assumes the user is authorized to make the export. Ideally, the Sidekiq job (
ProjectExportWorker) that is scheduled would do an authorization check to make sure that the user is authorized to export the project. This would also avoid a TOCTOU issue where the user schedules a job when the queue is clogged / Sidekiq workers are paused and would leave the project before the job is executed.
Edited by Jeremy Matos