diff options
| author | Douglas Barbosa Alexandre <dbalexandre@gmail.com> | 2016-10-04 15:37:13 -0300 |
|---|---|---|
| committer | Phil Hughes <me@iamphill.com> | 2016-10-06 11:00:01 +0100 |
| commit | e7a4bbb04a86259a569f6ac239ecb35ad36f39b5 (patch) | |
| tree | 80c6cbca068515c322d58ba7b835f306693048bf | |
| parent | 905af8471691fc0bb991aca5276185796dbe28c9 (diff) | |
| download | gitlab-ce-e7a4bbb04a86259a569f6ac239ecb35ad36f39b5.tar.gz | |
Add authorization to Projects::Boards::IssuesController#create action
| -rw-r--r-- | app/controllers/projects/boards/issues_controller.rb | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/app/controllers/projects/boards/issues_controller.rb b/app/controllers/projects/boards/issues_controller.rb index 3b1b236a89a..fea7a35232d 100644 --- a/app/controllers/projects/boards/issues_controller.rb +++ b/app/controllers/projects/boards/issues_controller.rb @@ -2,6 +2,7 @@ module Projects module Boards class IssuesController < Boards::ApplicationController before_action :authorize_read_issue!, only: [:index] + before_action :authorize_create_issue!, only: [:create] before_action :authorize_update_issue!, only: [:update] def index @@ -52,6 +53,10 @@ module Projects return render_403 unless can?(current_user, :read_issue, project) end + def authorize_create_issue! + return render_403 unless can?(current_user, :admin_issue, project) + end + def authorize_update_issue! return render_403 unless can?(current_user, :update_issue, issue) end |