gitlab-org--gitlab-foss/changelogs/unreleased/jej-fix-missing-access-check-on-issues.yml at 7c2e16d05319fa79d0b84472130c4a9300e08808 - kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss - Forgejo by Causa Arcana

kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss

Douwe Maan 6d37fe952b Merge branch 'jej-fix-missing-access-check-on-issues' into 'security'

Fix missing access checks on issue lookup using IssuableFinder

Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867

⚠️ - Potentially untested
💣 - No test coverage
🚥 - Test coverage of some sort exists (a test failed when error raised)
🚦 - Test coverage of return value (a test failed when nil used)
✅ - Permissions check tested

- [x] ✅ app/controllers/projects/branches_controller.rb:39
  - `before_action :authorize_push_code!` helpes limit/prevent exploitation. Always checks for reporter access so fine with
    confidential issues, issues only visible to team, etc.
- [x] 🚥 app/models/cycle_analytics/summary.rb:9 [`.count`]
- [x] ✅ app/controllers/projects/todos_controller.rb:19

- [x] Potential double render in app/controllers/projects/todos_controller.rb

- https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#cedccb227af9bfdf88802767cb58d43c2b977439_24_24

See merge request !2030

2016-11-28 21:25:46 -03:00

4 lines

99 B

YAML

Raw Blame History

 ---
 title: Fix missing access checks on issue lookup using IssuableFinder
 merge_request:
 author: