Authorize read_pipeline before read_build

10ba7141 · Matija Čupić · 6d1cb1f2 · 10ba7141
Verified Commit 10ba7141 authored 6 years ago by Matija Čupić
--- a/lib/api/jobs.rb
+++ b/lib/api/jobs.rb
@@ -59,6 +59,7 @@ module API
      # rubocop: disable CodeReuse/ActiveRecord
      get ':id/pipelines/:pipeline_id/jobs' do
        pipeline = user_project.pipelines.find(params[:pipeline_id])
+        authorize!(:read_pipeline, user_project)
        authorize!(:read_build, pipeline)
  
        builds = pipeline.builds