Fix permission escalation by not allowing to bump shared_runners_minutes by regular user

7e904919 · Kamil Trzcinski · 8c47ec83 · 7e904919 · 7e904919
Commit 7e904919 authored Dec 20, 2016 by Kamil Trzcinski
Hide whitespace changes
Inline Side-by-side

Showing with 0 additions and 3 deletions

app/controllers/groups_controller.rb app/controllers/groups_controller.rb +0 -1

app/views/groups/edit.html.haml app/views/groups/edit.html.haml +0 -2

No files found.
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -132,7 +132,6 @@ class GroupsController < Groups::ApplicationController
      :repository_size_limit,
      :request_access_enabled,
      :share_with_group_lock,
-      :shared_runners_minutes_limit,
      :visibility_level
    )
  end

--- a/app/views/groups/edit.html.haml
+++ b/app/views/groups/edit.html.haml
@@ -30,8 +30,6 @@

      = render 'group_lfs_settings', f: f

-      = render 'shared_runners_minutes_setting', f: f
-
      .form-group
        %hr
        = f.label :membership_lock, class: 'control-label' do