From e9d3b9659525c23a1d8c3b755c792040a5b41148 Mon Sep 17 00:00:00 2001 From: Sebastian Ziebell Date: Sat, 16 Feb 2013 14:42:49 +0100 Subject: API: fixes visibility of project hook When a user is not authorized to see the list of hooks for a project, he is still able to access the hooks separately. For example if access to `GET /projects/:id/hooks` fails and returns a `403 Unauthorized` error it is still possible to access a hook directly via `GET /projects/:id/hooks/:hook_id`. Fixes access, also added tests to check access and status codes of hooks. --- lib/api/projects.rb | 1 + 1 file changed, 1 insertion(+) (limited to 'lib/api') diff --git a/lib/api/projects.rb b/lib/api/projects.rb index d416121a78a..921aa237f26 100644 --- a/lib/api/projects.rb +++ b/lib/api/projects.rb @@ -155,6 +155,7 @@ module Gitlab # Example Request: # GET /projects/:id/hooks/:hook_id get ":id/hooks/:hook_id" do + authorize! :admin_project, user_project @hook = user_project.hooks.find(params[:hook_id]) present @hook, with: Entities::Hook end -- cgit v1.2.1