tree 74f862811dcc8c347cd59052bd184fcfb031bdb4
parent ba566c3690926db770fc0b1161b2d72bb524d256
author Edwin Kempin <ekempin@google.com> 1620826279 +0000
committer Edwin Kempin <ekempin@google.com> 1620827875 +0000

Check for inbound emails that the change is visible

Via inbound emails users could post comments on changes that were not
visible to them (changes of projects to which they have no read access,
non-visible private changes).

The user posting the comment didn't get added as a reviewer though. This
means that this hole couldn't be used to gain access to private changes.

A visibility check wasn't done so far since we used an InternalQuery
which has enforceVisibility = false by default.

With this change the error message if a change/project doesn't exist or
is not visible is always the same so that users cannot probe the
existence of a project or change.

Signed-off-by: Edwin Kempin <ekempin@google.com>
Change-Id: I98e1af7d0386fd7b29162fd76ef99270d7e0defc