pull-requests: security, check for permissions on exposure of repo-refs

2017-11-18 19:37:47 +01:00 · 2017-11-18 19:37:47 +01:00 · 6c435973fe
commit 6c435973fe
parent bdccd1a75f
1 changed files with 7 additions and 0 deletions
--- a/rhodecode/apps/repository/views/repo_pull_requests.py
+++ b/rhodecode/apps/repository/views/repo_pull_requests.py
@ -681,6 +681,13 @@ class RepoPullRequestsView(RepoAppView, DataGridAppView):
        repo = Repository.get_by_repo_name(target_repo_name)
        if not repo:
            raise HTTPNotFound()
+
+        target_perm = HasRepoPermissionAny(
+            'repository.read', 'repository.write', 'repository.admin')(
+            target_repo_name)
+        if not target_perm:
+            raise HTTPNotFound()
+
        return PullRequestModel().generate_repo_data(
            repo, translator=self.request.translate)