Download as
Browse Code »

Commit 9ea5766c3554843b88bfb65de48872ccd50363e7

Authored by Dmitriy Zaporozhets
1 parent 29306dd6
Exists in master and in 4 other branches 6-8-stable, 7-0-stable, 7-0-stable-spb, spb-stable

Improve permissions on tags/branches

Showing 4 changed files with 11 additions and 3 deletions   Show diff stats
app/controllers/application_controller.rb
  Diff comments   View file @9ea5766
... ... @@ -91,6 +91,10 @@ class ApplicationController < ActionController::Base
91 91 return access_denied! unless can?(current_user, :download_code, project) or project.public?
92 92 end
93 93  
  94 + def authorize_push!
  95 + return access_denied! unless can?(current_user, :push_code, project)
  96 + end
  97 +
94 98 def authorize_create_team!
95 99 return access_denied! unless can?(current_user, :create_team, nil)
96 100 end
... ...
app/controllers/projects/branches_controller.rb
  Diff comments   View file @9ea5766
... ... @@ -3,7 +3,9 @@ class Projects::BranchesController < Projects::ApplicationController
3 3 before_filter :authorize_read_project!
4 4 before_filter :require_non_empty_project
5 5  
6   - before_filter :authorize_admin_project!, only: [:destroy, :create]
  6 + before_filter :authorize_code_access!
  7 + before_filter :authorize_push!, only: [:create]
  8 + before_filter :authorize_admin_project!, only: [:destroy]
7 9  
8 10 def index
9 11 @branches = Kaminari.paginate_array(@repository.branches).page(params[:page]).per(30)
... ...
app/controllers/projects/tags_controller.rb
  Diff comments   View file @9ea5766
1 1 class Projects::TagsController < Projects::ApplicationController
2 2 # Authorize
3 3 before_filter :authorize_read_project!
4   - before_filter :authorize_code_access!
5 4 before_filter :require_non_empty_project
6 5  
7   - before_filter :authorize_admin_project!, only: [:destroy, :create]
  6 + before_filter :authorize_code_access!
  7 + before_filter :authorize_push!, only: [:create]
  8 + before_filter :authorize_admin_project!, only: [:destroy]
8 9  
9 10 def index
10 11 @tags = Kaminari.paginate_array(@project.repository.tags).page(params[:page]).per(30)
... ...
app/views/projects/repositories/_filter.html.haml
  Diff comments   View file @9ea5766
... ... @@ -10,6 +10,7 @@
10 10  
11 11  
12 12 %hr
  13 +- if can? current_user, :push_code, @project
13 14 = link_to new_project_branch_path(@project), class: 'btn btn-create' do
14 15 %i.icon-add-sign
15 16 New branch
... ...