![]() The `access_git` and `access_api` were currently never checked for anonymous users. And they would also be allowed access: An anonymous user can clone and pull from a public repo An anonymous user can request public information from the API So the policy didn't actually reflect what we were enforcing. |
||
---|---|---|
.. | ||
application_setting | ||
ci | ||
clusters | ||
base_policy_spec.rb | ||
deploy_key_policy_spec.rb | ||
deploy_token_policy_spec.rb | ||
environment_policy_spec.rb | ||
global_policy_spec.rb | ||
group_policy_spec.rb | ||
issuable_policy_spec.rb | ||
issue_policy_spec.rb | ||
namespace_policy_spec.rb | ||
note_policy_spec.rb | ||
personal_snippet_policy_spec.rb | ||
project_policy_spec.rb | ||
project_snippet_policy_spec.rb | ||
protected_branch_policy_spec.rb | ||
user_policy_spec.rb |