tree 2c7acb4825c5817b6d20f50b287cb211501dea65
parent 659ea71969d1d02da93e762d8924c1068f451387
author Patrick Hiesel <hiesel@google.com> 1519125573 +0100
committer Patrick Hiesel <hiesel@google.com> 1522159065 +0200

Remove PermissionBackend#user(Provider<CurrentUser>)

Checking permissions of users that aren't the caller on the current request
can have implications on the security of the system. The most prominent
one is creating a group-oracle.

To limit the cases where we could potentially expose Gerrit to these
threats, PermissionBackend removes the method that was operating solely
on the provider of the current user.

Change-Id: I601ea1200a15a5f262ca0770b23cc1c7bee126b1