gitlab-org--gitlab-foss/changelogs/unreleased/security-notes-in-private-snippets.yml

---
title: Correctly check permissions when creating snippet notes
merge_request:
author:
type: security
Correctly check permissions when creating snippet notes In the Snippets::NotesController the noteable was resolved and authorized through the :snippet_id, so by passing a :target_id for a different snippet it was possible to create a note on a snippet where the user would be unauthorized to do so otherwise. This fixes the problem by ignoring the :target_id and :target_type from the request, and using the same noteable for creation and authorization. 2019-05-31 12:18:09 -04:00			`---`
			`title: Correctly check permissions when creating snippet notes`
			`merge_request:`
			`author:`
			`type: security`