Hide `/tag` quick action from non-authorised users

2018-07-23 22:37:23 +02:00 · 2018-07-23 22:37:23 +02:00 · c491d86473
parent 839b776f87
commit c491d86473
1 changed files with 1 additions and 2 deletions
--- a/app/services/quick_actions/interpret_service.rb
+++ b/app/services/quick_actions/interpret_service.rb
@ -592,8 +592,7 @@ module QuickActions
      tag_name_and_message.split(' ', 2)
    end
    condition do
-      issuable.is_a?(Commit)
-      # TODO authorize
+      issuable.is_a?(Commit) && current_user.can?(:push_code, project)
    end
    command :tag do |(tag_name, message)|
      @updates[:tag_name] = tag_name