code: Add logic to check for online commit permissions

yona-projects · Mar 13, 2017 · 06dd16b · 06dd16b
1 parent a4dd951
commit 06dd16b
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/app/controllers/BoardApp.java b/app/controllers/BoardApp.java
@@ -173,6 +173,11 @@ public static Result newPostForm(String userName, String projectName) {
         }
 
         if (textFileEditRequested()) {
+            boolean isAllowedToFileEdit =
+                    AccessControl.isProjectResourceCreatable(UserApp.currentUser(), project, ResourceType.COMMIT);
+            if(!isAllowedToFileEdit){
+                return forbidden(ErrorViews.Forbidden.render("error.forbidden", project));
+            }
             preparedBodyText = GitUtil.getReadTextFile(project,
                     getBranchNameFromQueryString(), request().getQueryString("path"));
         }