From ed6c8238f3524feeab187b607362806ed1c666ad Mon Sep 17 00:00:00 2001
From: Douwe Maan <douwe@selenight.nl>
Date: Mon, 25 Jul 2016 22:40:44 -0600
Subject: [PATCH] Add access checks for diff note and discussion resolution

---
 app/models/ability.rb    | 8 +++++++-
 app/models/discussion.rb | 8 ++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/app/models/ability.rb b/app/models/ability.rb
index f33c8d61d3f..ac3bf441c32 100644
--- a/app/models/ability.rb
+++ b/app/models/ability.rb
@@ -257,6 +257,7 @@ class Ability
         :create_merge_request,
         :create_wiki,
         :push_code,
+        :resolve_note,
         :create_container_image,
         :update_container_image,
         :create_environment,
@@ -426,7 +427,8 @@ class Ability
         rules += [
           :read_note,
           :update_note,
-          :admin_note
+          :admin_note,
+          :resolve_note
         ]
       end
 
@@ -434,6 +436,10 @@ class Ability
         rules += project_abilities(user, note.project)
       end
 
+      if note.for_merge_request? && note.noteable.author == user
+        rules << :resolve_note
+      end
+
       rules
     end
 
diff --git a/app/models/discussion.rb b/app/models/discussion.rb
index 64116d225ae..cc586933112 100644
--- a/app/models/discussion.rb
+++ b/app/models/discussion.rb
@@ -63,6 +63,14 @@ class Discussion
     notes.any?(&:to_be_resolved?)
   end
 
+  def can_resolve?(current_user)
+    return false unless current_user
+    return false unless resolvable?
+
+    current_user == self.noteable.author ||
+      can?(current_user, :push_code, self.project)
+  end
+
   def resolve!(current_user)
     notes.each do |note|
       note.resolve!(current_user) if note.resolvable?