gitlab-org--gitlab-foss/app/finders/group_finder.rb
Sean McGivern 91f43587a8 Merge branch 'jej-group-name-disclosure' into 'security'
Prevent private group disclosure via parent_id

See merge request !2077
2017-03-29 19:18:38 -07:00

17 lines
273 B
Ruby

class GroupFinder
include Gitlab::Allowable
def initialize(current_user)
@current_user = current_user
end
def execute(*params)
group = Group.find_by(*params)
if can?(@current_user, :read_group, group)
group
else
nil
end
end
end