Commit 1f813024 authored by Douwe Maan's avatar Douwe Maan

Don't leak existence of project via search autocomplete.

parent 24d139ba
Please view this file on the master branch, on stable branches it's out of date. Please view this file on the master branch, on stable branches it's out of date.
v 7.10.0 (unreleased) v 7.10.0 (unreleased)
- Don't leak existence of project via search autocomplete.
- Fix broken file browsing with a submodule that contains a relative link (Stan Hu)
- Fix bug where Wiki pages that included a '/' were no longer accessible (Stan Hu) - Fix bug where Wiki pages that included a '/' were no longer accessible (Stan Hu)
- Fix bug where error messages from Dropzone would not be displayed on the issues page (Stan Hu) - Fix bug where error messages from Dropzone would not be displayed on the issues page (Stan Hu)
- Add ability to configure Reply-To address in gitlab.yml (Stan Hu) - Add ability to configure Reply-To address in gitlab.yml (Stan Hu)
......
...@@ -35,7 +35,12 @@ class SearchController < ApplicationController ...@@ -35,7 +35,12 @@ class SearchController < ApplicationController
def autocomplete def autocomplete
term = params[:term] term = params[:term]
@project = Project.find(params[:project_id]) if params[:project_id].present?
if params[:project_id].present?
@project = Project.find_by(id: params[:project_id])
@project = nil unless can?(current_user, :read_project, @project)
end
@ref = params[:project_ref] if params[:project_ref].present? @ref = params[:project_ref] if params[:project_ref].present?
render json: search_autocomplete_opts(term).to_json render json: search_autocomplete_opts(term).to_json
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment