Download as
Browse Code »

Commit b32a8eea939930cd49141526b5fec19c747c561d

Authored by Valeriy Sizov
1 parent 524b9070
Exists in master and in 4 other branches 6-8-stable, 7-0-stable, 7-0-stable-spb, spb-stable

API: MergeRequest: authorization

Showing 1 changed file with 11 additions and 1 deletions   Show diff stats
lib/api/merge_requests.rb
  Diff comments   View file @b32a8ee
@@ -6,12 +6,18 @@ module Gitlab @@ -6,12 +6,18 @@ module Gitlab
6 resource :projects do 6 resource :projects do
7 #list 7 #list
8 get ":id/merge_requests" do 8 get ":id/merge_requests" do
  9 + authorize! :read_merge_request, user_project
  10 +
9 present user_project.merge_requests, with: Entities::MergeRequest 11 present user_project.merge_requests, with: Entities::MergeRequest
10 end 12 end
11 13
12 #show 14 #show
13 get ":id/merge_request/:merge_request_id" do 15 get ":id/merge_request/:merge_request_id" do
14 - present user_project.merge_requests.find(params[:merge_request_id]), with: Entities::MergeRequest 16 + merge_request = user_project.merge_requests.find(params[:merge_request_id])
  17 +
  18 + authorize! :read_merge_request, merge_request
  19 +
  20 + present merge_request, with: Entities::MergeRequest
15 end 21 end
16 22
17 #create merge_request 23 #create merge_request
@@ -20,6 +26,8 @@ module Gitlab @@ -20,6 +26,8 @@ module Gitlab
20 merge_request = user_project.merge_requests.new(attrs) 26 merge_request = user_project.merge_requests.new(attrs)
21 merge_request.author = current_user 27 merge_request.author = current_user
22 28
  29 + authorize! :write_merge_request, merge_request
  30 +
23 if merge_request.save 31 if merge_request.save
24 merge_request.reload_code 32 merge_request.reload_code
25 present merge_request, with: Entities::MergeRequest 33 present merge_request, with: Entities::MergeRequest
@@ -33,6 +41,8 @@ module Gitlab @@ -33,6 +41,8 @@ module Gitlab
33 attrs = attributes_for_keys [:source_branch, :target_branch, :assignee_id, :title, :closed] 41 attrs = attributes_for_keys [:source_branch, :target_branch, :assignee_id, :title, :closed]
34 merge_request = user_project.merge_requests.find(params[:merge_request_id]) 42 merge_request = user_project.merge_requests.find(params[:merge_request_id])
35 43
  44 + authorize! :modify_merge_request, merge_request
  45 +
36 if merge_request.update_attributes attrs 46 if merge_request.update_attributes attrs
37 merge_request.reload_code 47 merge_request.reload_code
38 merge_request.mark_as_unchecked 48 merge_request.mark_as_unchecked