Skip to content
Unverified Commit a89c7c6f authored by Markus Koller's avatar Markus Koller
Browse files

Correctly check permissions when creating snippet notes

In the Snippets::NotesController the noteable was resolved and
authorized through the :snippet_id, so by passing a :target_id for a
different snippet it was possible to create a note on a snippet
where the user would be unauthorized to do so otherwise.

This fixes the problem by ignoring the :target_id and :target_type from
the request, and using the same noteable for creation and authorization.
parent 3c240b7a
Loading
Loading
Loading