Add authorization to hooks requests

1 files changed, 3 insertions, 0 deletions

diff --git a/lib/api/projects.rb b/lib/api/projects.rb
index dfdd359c2b2..cf23dc5f538 100644
--- a/lib/api/projects.rb
+++ b/lib/api/projects.rb
@@ -113,6 +113,7 @@ module Gitlab
       # Example Request:
       #   GET /projects/:id/hooks
       get ":id/hooks" do
+        authorize! :admin_project, user_project
         @hooks = paginate user_project.hooks
         present @hooks, with: Entities::Hook
       end
@@ -125,6 +126,7 @@ module Gitlab
       # Example Request:
       #   POST /projects/:id/hooks
       post ":id/hooks" do
+        authorize! :admin_project, user_project
         @hook = user_project.hooks.new({"url" => params[:url]})
         if @hook.save
           present @hook, with: Entities::Hook
@@ -141,6 +143,7 @@ module Gitlab
       # Example Request:
       #   DELETE /projects/:id/hooks
       delete ":id/hooks" do
+        authorize! :admin_project, user_project
         @hook = user_project.hooks.find(params[:hook_id])
         @hook.destroy
         nil