diff options
| author | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2015-06-26 14:37:45 +0000 |
|---|---|---|
| committer | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2015-06-26 14:37:45 +0000 |
| commit | 05ef7ba105b05f143e44cca696ceedc0a2eae34a (patch) | |
| tree | 5aedb45ab10bf54577c2d5182492bd93666e3dc7 /lib/api | |
| parent | c342a9abccf27471a631c047b01911a242ce1106 (diff) | |
| parent | 58ceb8e95097df51d08a74c16de83152044e9c58 (diff) | |
| download | gitlab-ce-05ef7ba105b05f143e44cca696ceedc0a2eae34a.tar.gz | |
Merge branch 'permission-improvements' into 'master'
Update permissions for issue tracker management
Don't allow guest or reporter to set assignee, milestone and label when create or update new issue and merge request.
After this change `Guest` and `Reporter` rule is used to report issues but only `Developer` and higher roles can manage issues (schedule milestone, assign to user or close any issue)
Also I removed some duplication code between issues and merge requests and put all issuable partials in one directory
See merge request !890
Diffstat (limited to 'lib/api')
| -rw-r--r-- | lib/api/issues.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/api/issues.rb b/lib/api/issues.rb index c8db93eb778..4d632ce77c1 100644 --- a/lib/api/issues.rb +++ b/lib/api/issues.rb @@ -157,7 +157,7 @@ module API if issue.valid? # Find or create labels and attach to issue. Labels are valid because # we already checked its name, so there can't be an error here - unless params[:labels].nil? + if params[:labels] && can?(current_user, :admin_issue, user_project) issue.remove_labels # Create and add labels to the new created issue issue.add_labels_by_names(params[:labels].split(',')) |