35b8f103a8
This changes the permission check so it uses the policy on Noteable instead of Project. This prevents bypassing of rules defined in Noteable for locked discussions and confidential issues. Also rechecks permissions when reply_to_discussion_id is provided since the discussion_id may be from a different noteable.
27 lines
834 B
Ruby
27 lines
834 B
Ruby
# frozen_string_literal: true
|
|
|
|
class IssuePolicy < IssuablePolicy
|
|
# This class duplicates the same check of Issue#readable_by? for performance reasons
|
|
# Make sure to sync this class checks with issue.rb to avoid security problems.
|
|
# Check commit 002ad215818450d2cbbc5fa065850a953dc7ada8 for more information.
|
|
|
|
desc "User can read confidential issues"
|
|
condition(:can_read_confidential) do
|
|
@user && IssueCollection.new([@subject]).visible_to(@user).any?
|
|
end
|
|
|
|
desc "Issue is confidential"
|
|
condition(:confidential, scope: :subject) { @subject.confidential? }
|
|
|
|
rule { confidential & ~can_read_confidential }.policy do
|
|
prevent :read_issue
|
|
prevent :read_issue_iid
|
|
prevent :update_issue
|
|
prevent :admin_issue
|
|
prevent :create_note
|
|
end
|
|
|
|
rule { locked }.policy do
|
|
prevent :reopen_issue
|
|
end
|
|
end
|