Dont expose project_path without read_project permission

7da454c5 · Giorgenes Gelatti · 861f6dcd · 7da454c5
Commit 7da454c5 authored Jan 09, 2020 by Giorgenes Gelatti
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

ee/lib/ee/api/entities.rb ee/lib/ee/api/entities.rb +1 -1

No files found.
--- a/ee/lib/ee/api/entities.rb
+++ b/ee/lib/ee/api/entities.rb
@@ -886,7 +886,7 @@ module EE
        expose :created_at
        expose :project_id, if: ->(_, opts) { opts[:group] }
-        expose :project_path, if: ->(_, opts) { opts[:group] }
+        expose :project_path, if: ->(obj, opts) { opts[:group] && Ability.allowed?(opts[:user], :read_project, obj.project) }
        private