Download as
Browse Code »

Commit 3ddd9f753c0a6a57313ea4860bf7167f98f53cd2

Authored by Dmitriy Zaporozhets
1 parent 70e05801
Exists in master and in 4 other branches 6-8-stable, 7-0-stable, 7-0-stable-spb, spb-stable

Fix mass-assignment. Dont allow users w/o access to create team

Showing 3 changed files with 9 additions and 8 deletions   Show diff stats
app/controllers/application_controller.rb
  Diff comments   View file @3ddd9f7
... ... @@ -94,6 +94,10 @@ class ApplicationController < ActionController::Base
94 94 return access_denied! unless can?(current_user, :download_code, project)
95 95 end
96 96  
  97 + def authorize_create_team!
  98 + return access_denied! unless can?(current_user, :create_team, nil)
  99 + end
  100 +
97 101 def authorize_manage_user_team!
98 102 return access_denied! unless user_team.present? && can?(current_user, :manage_user_team, user_team)
99 103 end
... ...
app/controllers/teams_controller.rb
  Diff comments   View file @3ddd9f7
1 1 class TeamsController < ApplicationController
2 2 # Authorize
3   - before_filter :authorize_manage_user_team!
4   - before_filter :authorize_admin_user_team!
  3 + before_filter :authorize_create_team!, only: [:new, :create]
  4 + before_filter :authorize_manage_user_team!, only: [:edit, :update]
  5 + before_filter :authorize_admin_user_team!, only: [:destroy]
5 6  
6   - # Skip access control on public section
7   - skip_before_filter :authorize_manage_user_team!, only: [:index, :show, :new, :destroy, :create, :search, :issues, :merge_requests]
8   - skip_before_filter :authorize_admin_user_team!, only: [:index, :show, :new, :create, :search, :issues, :merge_requests]
9   -
10   - layout 'user_team', only: [:show, :edit, :update, :destroy, :issues, :merge_requests, :search]
  7 + layout 'user_team', except: [:new, :create]
11 8  
12 9 def index
13 10 @teams = current_user.user_teams.order('name ASC')
... ...
app/models/user.rb
  Diff comments   View file @3ddd9f7
... ... @@ -40,7 +40,7 @@ class User &lt; ActiveRecord::Base
40 40 attr_accessible :email, :password, :password_confirmation, :remember_me, :bio, :name, :username,
41 41 :skype, :linkedin, :twitter, :dark_scheme, :theme_id, :force_random_password,
42 42 :extern_uid, :provider, as: [:default, :admin]
43   - attr_accessible :projects_limit, as: :admin
  43 + attr_accessible :projects_limit, :can_create_team, :can_create_group, as: :admin
44 44  
45 45 attr_accessor :force_random_password
46 46  
... ...