deac/gitlabhq
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

security improved

Browse source
This commit is contained in:
gitlabhq 2011-10-17 13:39:03 +03:00
parent b08e4074b4
commit 783ca89796
9 changed files with 74 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

4
app/controllers/notes_controller.rb
View file

@ -4,7 +4,6 @@ class NotesController < ApplicationController
# Authorize
before_filter :add_project_abilities
before_filter :authorize_write_note!, :only => [:create]
before_filter :authorize_admin_note!, :only => [:destroy]
respond_to :js
@ -25,6 +24,9 @@ class NotesController < ApplicationController
def destroy
@note = @project.notes.find(params[:id])
return access_denied! unless can?(current_user, :admin_note, @note)
@note.destroy
respond_to do |format|