742cee756b
Fix information disclosure in `Projects::BlobController#update` It was possible to discover private project names by modifying `from_merge_request`parameter in `Projects::BlobController#update`. This fixes that. - [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.md) entry added - Tests - [x] Added for this feature/bug - [ ] All builds are passing - [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html) - [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides) - [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits) https://gitlab.com/gitlab-org/gitlab-ce/issues/22869 See merge request !2023 |
||
---|---|---|
.. | ||
boards | ||
avatars_controller_spec.rb | ||
blame_controller_spec.rb | ||
blob_controller_spec.rb | ||
boards_controller_spec.rb | ||
branches_controller_spec.rb | ||
commit_controller_spec.rb | ||
commits_controller_spec.rb | ||
compare_controller_spec.rb | ||
cycle_analytics_controller_spec.rb | ||
discussions_controller_spec.rb | ||
environments_controller_spec.rb | ||
find_file_controller_spec.rb | ||
forks_controller_spec.rb | ||
graphs_controller_spec.rb | ||
group_links_controller_spec.rb | ||
imports_controller_spec.rb | ||
issues_controller_spec.rb | ||
labels_controller_spec.rb | ||
merge_requests_controller_spec.rb | ||
milestones_controller_spec.rb | ||
notes_controller_spec.rb | ||
project_members_controller_spec.rb | ||
protected_branches_controller_spec.rb | ||
raw_controller_spec.rb | ||
refs_controller_spec.rb | ||
repositories_controller_spec.rb | ||
services_controller_spec.rb | ||
snippets_controller_spec.rb | ||
tags_controller_spec.rb | ||
templates_controller_spec.rb | ||
todo_controller_spec.rb | ||
tree_controller_spec.rb | ||
uploads_controller_spec.rb |