diff options
| author | Douwe Maan <douwe@gitlab.com> | 2016-06-06 08:59:06 +0000 |
|---|---|---|
| committer | Douwe Maan <douwe@gitlab.com> | 2016-06-06 08:59:06 +0000 |
| commit | 184aa5216731cc51bbab5ce6d8e0b71340a58693 (patch) | |
| tree | 6777db2a0747ac21993903c54fed5391e630e2fb /app/controllers | |
| parent | fc809d689a03e69c581c1bb8ed0cf246953a7c08 (diff) | |
| parent | 1f608ac4614f57130992916931ad10f4d5fd9d50 (diff) | |
| download | gitlab-ce-184aa5216731cc51bbab5ce6d8e0b71340a58693.tar.gz | |
Merge branch 'fix/unauthorized-access-to-build-data' into 'master'
Remove 'unscoped' from project builds selection
This is a fix for this security bug: https://gitlab.com/gitlab-org/gitlab-ce/issues/18188
/cc @kamil @grzegorz @stanhu
See merge request !1968
Diffstat (limited to 'app/controllers')
| -rw-r--r-- | app/controllers/projects/artifacts_controller.rb | 2 | ||||
| -rw-r--r-- | app/controllers/projects/builds_controller.rb | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/app/controllers/projects/artifacts_controller.rb b/app/controllers/projects/artifacts_controller.rb index cfea1266516..832d7deb57d 100644 --- a/app/controllers/projects/artifacts_controller.rb +++ b/app/controllers/projects/artifacts_controller.rb @@ -37,7 +37,7 @@ class Projects::ArtifactsController < Projects::ApplicationController private def build - @build ||= project.builds.unscoped.find_by!(id: params[:build_id]) + @build ||= project.builds.find_by!(id: params[:build_id]) end def artifacts_file diff --git a/app/controllers/projects/builds_controller.rb b/app/controllers/projects/builds_controller.rb index bb1f6c5e980..db3ae586059 100644 --- a/app/controllers/projects/builds_controller.rb +++ b/app/controllers/projects/builds_controller.rb @@ -81,7 +81,7 @@ class Projects::BuildsController < Projects::ApplicationController private def build - @build ||= project.builds.unscoped.find_by!(id: params[:id]) + @build ||= project.builds.find_by!(id: params[:id]) end def build_path(build) |