deac/gitlabhq
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fix mass-assignment. Dont allow users w/o access to create team

Browse source
This commit is contained in:
Dmitriy Zaporozhets 2013-01-25 15:42:41 +02:00
parent 70e05801b1
commit 3ddd9f753c
3 changed files with 9 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
app/controllers/application_controller.rb
View file

@ -94,6 +94,10 @@ class ApplicationController < ActionController::Base
return access_denied! unless can?(current_user, :download_code, project)
end
def authorize_create_team!
return access_denied! unless can?(current_user, :create_team, nil)
end
def authorize_manage_user_team!
return access_denied! unless user_team.present? && can?(current_user, :manage_user_team, user_team)
end