91f43587a8
Prevent private group disclosure via parent_id See merge request !2077
17 lines
273 B
Ruby
17 lines
273 B
Ruby
class GroupFinder
|
|
include Gitlab::Allowable
|
|
|
|
def initialize(current_user)
|
|
@current_user = current_user
|
|
end
|
|
|
|
def execute(*params)
|
|
group = Group.find_by(*params)
|
|
|
|
if can?(@current_user, :read_group, group)
|
|
group
|
|
else
|
|
nil
|
|
end
|
|
end
|
|
end
|