Add a permission check in ProjectExportWorker to make sure user has sufficient permissions at export time

This is the 3rd vulnerability described at https://gitlab.com/gitlab-org/gitlab-ce/issues/67109

This is where the third vulnerability can be found. When an export job is scheduled, it assumes the user is authorized to make the export. Ideally, the Sidekiq job (ProjectExportWorker) that is scheduled would do an authorization check to make sure that the user is authorized to export the project. This would also avoid a TOCTOU issue where the user schedules a job when the queue is clogged / Sidekiq workers are paused and would leave the project before the job is executed.

Edited Sep 09, 2019 by Jeremy Matos
Assignee Loading
Time tracking Loading