d30a90a354
* Prevent creating notes on inaccessible MRs This applies the notes rules at the MR scope. Rather than adding extra rules to the Project level policy, preventing :create_note here is better since it only prevents creating notes on MRs. * Prevent creating notes in inaccessible Issues without this policy, non-team-members are allowed to comment on issues even when the project has the private-issues policy set. This means that without this change, users are allowed to comment on issues that they cannot read. * Add CHANGELOG entry
3 lines
101 B
YAML
3 lines
101 B
YAML
---
|
|
title: Ensure only authorised users can create notes on Merge Requests and Issues
|
|
type: security
|