Authorize read_pipeline before read_build

89b856e7 · Matija Čupić · a1c77f2d · 89b856e7
Commit 89b856e7 authored Dec 18, 2018 by Matija Čupić
Show whitespace changes
Inline Side-by-side

Showing with 1 addition and 0 deletions

lib/api/jobs.rb lib/api/jobs.rb +1 -0

No files found.
--- a/lib/api/jobs.rb
+++ b/lib/api/jobs.rb
@@ -59,6 +59,7 @@ module API
      # rubocop: disable CodeReuse/ActiveRecord
      get ':id/pipelines/:pipeline_id/jobs' do
        pipeline = user_project.ci_pipelines.find(params[:pipeline_id])
+        authorize!(:read_pipeline, user_project)
        authorize!(:read_build, pipeline)

        builds = pipeline.builds