From a196aaa2a97b6ce23e6ec4c5d5fad30c65a22034 Mon Sep 17 00:00:00 2001 From: Jean-Philippe Lang Date: Wed, 4 Nov 2015 18:17:07 +0000 Subject: Fixed that Issues API may disclose changesets that are not visible (#21136). git-svn-id: http://svn.redmine.org/redmine/trunk@14794 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- app/views/issues/show.api.rsb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'app') diff --git a/app/views/issues/show.api.rsb b/app/views/issues/show.api.rsb index f057b4c63..577a885c2 100644 --- a/app/views/issues/show.api.rsb +++ b/app/views/issues/show.api.rsb @@ -40,14 +40,14 @@ api.issue do end if include_in_api_response?('relations') && @relations.present? api.array :changesets do - @issue.changesets.each do |changeset| + @changesets.each do |changeset| api.changeset :revision => changeset.revision do api.user(:id => changeset.user_id, :name => changeset.user.name) unless changeset.user.nil? api.comments changeset.comments api.committed_on changeset.committed_on end end - end if include_in_api_response?('changesets') && User.current.allowed_to?(:view_changesets, @project) + end if include_in_api_response?('changesets') api.array :journals do @journals.each do |journal| -- cgit v1.2.3