##// END OF EJS Templates
Redmine.pm: deny access if user doesn't have browse_repository permission (#4338)....
Jean-Philippe Lang -
r3101:ffe8222257d4
parent child
Show More
@@ -284,7 +284,7 sub is_member {
284
284
285 unless ($auth_source_id) {
285 unless ($auth_source_id) {
286 my $method = $r->method;
286 my $method = $r->method;
287 if ($hashed_password eq $pass_digest && (defined $read_only_methods{$method} || $permissions =~ /:commit_access/) ) {
287 if ($hashed_password eq $pass_digest && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {
288 $ret = 1;
288 $ret = 1;
289 last;
289 last;
290 }
290 }
General Comments 0
You need to be logged in to leave comments. Login now