#312: check permissions for #log action

2013-10-24 13:26:15 +04:00 · 2013-10-24 13:26:15 +04:00 · 0b56e95fb2
parent 48212bb2b2
commit 0b56e95fb2
1 changed files with 3 additions and 1 deletions
--- a/app/controllers/api/v1/jobs_controller.rb
+++ b/app/controllers/api/v1/jobs_controller.rb
@ -49,7 +49,9 @@ class Api::V1::JobsController < Api::V1::BaseController
  def logs
    name = params[:name]
    if name =~ /abfworker::rpm-worker/
-      BuildList.log_server.setex name, 15, params[:logs]
+      if current_user.system? || current_user.id == BuildList.where(:id => name.gsub(/[^\d]/, '')).first.try(:builder_id)
+        BuildList.log_server.setex name, 15, params[:logs]
+      end
    end
    render :nothing => true
  end