d30a90a354
* Prevent creating notes on inaccessible MRs This applies the notes rules at the MR scope. Rather than adding extra rules to the Project level policy, preventing :create_note here is better since it only prevents creating notes on MRs. * Prevent creating notes in inaccessible Issues without this policy, non-team-members are allowed to comment on issues even when the project has the private-issues policy set. This means that without this change, users are allowed to comment on issues that they cannot read. * Add CHANGELOG entry
13 lines
461 B
Ruby
13 lines
461 B
Ruby
# frozen_string_literal: true
|
|
|
|
class MergeRequestPolicy < IssuablePolicy
|
|
rule { locked }.policy do
|
|
prevent :reopen_merge_request
|
|
end
|
|
|
|
# Only users who can read the merge request can comment.
|
|
# Although :read_merge_request is computed in the policy context,
|
|
# it would not be safe to prevent :create_note there, since
|
|
# note permissions are shared, and this would apply too broadly.
|
|
rule { ~can?(:read_merge_request) }.prevent :create_note
|
|
end
|