742cee756b
Fix information disclosure in `Projects::BlobController#update` It was possible to discover private project names by modifying `from_merge_request`parameter in `Projects::BlobController#update`. This fixes that. - [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.md) entry added - Tests - [x] Added for this feature/bug - [ ] All builds are passing - [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html) - [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides) - [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits) https://gitlab.com/gitlab-org/gitlab-ce/issues/22869 See merge request !2023
18 lines
1.1 KiB
Text
18 lines
1.1 KiB
Text
.diff-file.file-holder{id: file_hash, data: diff_file_html_data(project, diff_file.file_path, diff_commit.id)}
|
|
.file-title{id: "file-path-#{hexdigest(diff_file.file_path)}"}
|
|
= render "projects/diffs/file_header", diff_file: diff_file, blob: blob, diff_commit: diff_commit, project: project, url: "##{file_hash}"
|
|
|
|
- unless diff_file.submodule?
|
|
.file-actions.hidden-xs
|
|
- if blob_text_viewable?(blob)
|
|
= link_to '#', class: 'js-toggle-diff-comments btn active has-tooltip btn-file-option', title: "Toggle comments for this file", disabled: @diff_notes_disabled do
|
|
= icon('comment')
|
|
\
|
|
- if editable_diff?(diff_file)
|
|
- link_opts = @merge_request.persisted? ? { from_merge_request_iid: @merge_request.iid } : {}
|
|
= edit_blob_link(@merge_request.source_project, @merge_request.source_branch, diff_file.new_path,
|
|
blob: blob, link_opts: link_opts)
|
|
|
|
= view_file_btn(diff_commit.id, diff_file.new_path, project)
|
|
|
|
= render 'projects/diffs/content', diff_file: diff_file, diff_commit: diff_commit, blob: blob, project: project
|