![]() - Use `GlobalPolicy` to authorize the users that a non-authenticated user can fetch from `/api/v4/users`. We allow access if the `Gitlab::VisibilityLevel::PUBLIC` visibility level is not restricted. - Further, as before, `/api/v4/users` is only accessible to unauthenticated users if the `username` parameter is passed. - Turn off `authenticate!` for the `/api/v4/users` endpoint by matching on the actual route + method, rather than the description. - Change the type of `current_user` check in `UsersFinder` to be more compatible with EE. |
||
---|---|---|
.. | ||
api | ||
assets | ||
backup | ||
banzai | ||
bitbucket | ||
ci | ||
constraints | ||
container_registry | ||
generators/rails/post_deployment_migration | ||
github | ||
gitlab | ||
json_web_token | ||
mattermost | ||
microsoft_teams | ||
omni_auth | ||
peek/rblineprof | ||
rouge | ||
support | ||
system_check | ||
tasks | ||
additional_email_headers_interceptor.rb | ||
banzai.rb | ||
disable_email_interceptor.rb | ||
email_template_interceptor.rb | ||
event_filter.rb | ||
expand_variables.rb | ||
extracts_path.rb | ||
feature.rb | ||
file_size_validator.rb | ||
file_streamer.rb | ||
gitlab.rb | ||
gt_one_coercion.rb | ||
repository_cache.rb | ||
static_model.rb | ||
system_check.rb | ||
unfold_form.rb | ||
uploaded_file.rb | ||
version_check.rb |