Code review comment for lp:~ricardokirkner/locolander/merge-request-views

Revision history for this message
Natalia Bidart (nataliabidart) wrote :

Branch looks great. There is only one blocker, and is in the merge_request_run view: the get_object_or_404 should ensure that the user currently logged is the owner of the project that holds the given merge request (otherwise anyone logged in could visit this url by knowing the MR id).

review: Needs Fixing

« Back to merge proposal