Merge pull request #3011 from Asquera/fix_access_to_nonvisible_hook

API: fixes visibility of project hook
2013-02-20 02:45:07 -08:00 · 2013-02-20 02:45:07 -08:00 · 25e4c512d4
commit 25e4c512d4
parent c56d32c73e e9d3b96595
2 changed files with 33 additions and 10 deletions
--- a/lib/api/projects.rb
+++ b/lib/api/projects.rb
@ -155,6 +155,7 @@ module Gitlab
      # Example Request:
      #   GET /projects/:id/hooks/:hook_id
      get ":id/hooks/:hook_id" do
+        authorize! :admin_project, user_project
        @hook = user_project.hooks.find(params[:hook_id])
        present @hook, with: Entities::Hook
      end