Skip to content

Fix build access policies when pipelines are public

Grzegorz Bizon requested to merge fix/ci-build-policy into master

What does this MR do?

This MR fixes Ci::Build policy. Case with public_builds? was already handled on the ProjectPolicy.

Before this change, it was possible to :read_build even when project was private and user was not a member of the project.

This didn't introduce security problem, because project visibility levels are being check in the parent controller.

Does this MR meet the acceptance criteria?

Merge request reports