diff options
| author | haseeb <haseebeqx@gmail.com> | 2017-09-18 17:29:17 +0000 |
|---|---|---|
| committer | Rémy Coutable <remy@rymai.me> | 2017-09-18 17:29:17 +0000 |
| commit | ff4e81e0aec38c26e75d960c3d2af9329576ca32 (patch) | |
| tree | 6903ef4fa30d5d467af3a9386423fcb7aeabb731 /lib/api | |
| parent | 8d568fe324dbf753e99e8f63df8f4cb1b484270d (diff) | |
| download | gitlab-ce-ff4e81e0aec38c26e75d960c3d2af9329576ca32.tar.gz | |
fix #35290 Make read-only API for public merge requests available without authentication
Diffstat (limited to 'lib/api')
| -rw-r--r-- | lib/api/merge_requests.rb | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/api/merge_requests.rb b/lib/api/merge_requests.rb index 56d72d511da..8aa1e0216ee 100644 --- a/lib/api/merge_requests.rb +++ b/lib/api/merge_requests.rb @@ -2,7 +2,7 @@ module API class MergeRequests < Grape::API include PaginationParams - before { authenticate! } + before { authenticate_non_get! } helpers ::Gitlab::IssuableMetadata @@ -55,6 +55,7 @@ module API desc: 'Return merge requests for the given scope: `created-by-me`, `assigned-to-me` or `all`' end get do + authenticate! unless params[:scope] == 'all' merge_requests = find_merge_requests options = { with: Entities::MergeRequestBasic, |