diff options
| author | Dmitriy Zaporozhets <dzaporozhets@gitlab.com> | 2015-03-03 20:05:12 +0000 |
|---|---|---|
| committer | Dmitriy Zaporozhets <dzaporozhets@gitlab.com> | 2015-03-03 20:05:12 +0000 |
| commit | 8c47a72a4ed3df2327104e029307b5d804525886 (patch) | |
| tree | 37070b999e2aa5dc6cbfdf14209575716d9e86af /lib/api/project_snippets.rb | |
| parent | a7fad44bd361c68c6f4ff0fbeb5ad067ef2b74b1 (diff) | |
| parent | 0e11be40c39df66859ae0f3dc265cd903820c153 (diff) | |
| download | gitlab-ce-8c47a72a4ed3df2327104e029307b5d804525886.tar.gz | |
Merge branch 'project-existence-leak' into 'master'
Don't leak information about private project existence via Git-over-SSH/HTTP.
Fixes #2040 and https://gitlab.com/gitlab-org/gitlab-ce/issues/343.
Both `Grack::Auth` (used by Git-over-HTTP) and `Api::Internal /allowed` (used by gitlab-shell/Git-over-SSH) now return a generic "Not Found" error when the project exists but the user doesn't have access to it.
See merge request !1578
Diffstat (limited to 'lib/api/project_snippets.rb')
0 files changed, 0 insertions, 0 deletions