Download as
Browse Code »

Commit b32a8eea939930cd49141526b5fec19c747c561d

Authored by Valeriy Sizov
1 parent 524b9070
Exists in master and in 4 other branches 6-8-stable, 7-0-stable, 7-0-stable-spb, spb-stable

API: MergeRequest: authorization

Showing 1 changed file with 11 additions and 1 deletions   Show diff stats
lib/api/merge_requests.rb
  Diff comments   View file @b32a8ee
... ... @@ -6,12 +6,18 @@ module Gitlab
6 6 resource :projects do
7 7 #list
8 8 get ":id/merge_requests" do
  9 + authorize! :read_merge_request, user_project
  10 +
9 11 present user_project.merge_requests, with: Entities::MergeRequest
10 12 end
11 13  
12 14 #show
13 15 get ":id/merge_request/:merge_request_id" do
14   - present user_project.merge_requests.find(params[:merge_request_id]), with: Entities::MergeRequest
  16 + merge_request = user_project.merge_requests.find(params[:merge_request_id])
  17 +
  18 + authorize! :read_merge_request, merge_request
  19 +
  20 + present merge_request, with: Entities::MergeRequest
15 21 end
16 22  
17 23 #create merge_request
... ... @@ -20,6 +26,8 @@ module Gitlab
20 26 merge_request = user_project.merge_requests.new(attrs)
21 27 merge_request.author = current_user
22 28  
  29 + authorize! :write_merge_request, merge_request
  30 +
23 31 if merge_request.save
24 32 merge_request.reload_code
25 33 present merge_request, with: Entities::MergeRequest
... ... @@ -33,6 +41,8 @@ module Gitlab
33 41 attrs = attributes_for_keys [:source_branch, :target_branch, :assignee_id, :title, :closed]
34 42 merge_request = user_project.merge_requests.find(params[:merge_request_id])
35 43  
  44 + authorize! :modify_merge_request, merge_request
  45 +
36 46 if merge_request.update_attributes attrs
37 47 merge_request.reload_code
38 48 merge_request.mark_as_unchecked
... ...