Merge branch 'dm-notes-actions-noteable-for-update' into 'master'

Make sure NotesActions#noteable returns a Noteable in the update action

Closes #40208

See merge request gitlab-org/gitlab-ce!15421

app/controllers/concerns/notes_actions.rb

@@ -4,7 +4,7 @@ module NotesActions
 
   included do
     before_action :set_polling_interval_header, only: [:index]
-    before_action :noteable, only: :index
+    before_action :require_noteable!, only: [:index, :create]
     before_action :authorize_admin_note!, only: [:update, :destroy]
     before_action :note_project, only: [:create]
   end
@@ -90,7 +90,7 @@ module NotesActions
     if note.persisted?
       attrs[:valid] = true
 
-      if noteable.nil? || noteable.discussions_rendered_on_frontend?
+      if noteable.discussions_rendered_on_frontend?
         attrs.merge!(note_serializer.represent(note))
       else
         attrs.merge!(
@@ -191,7 +191,11 @@ module NotesActions
   end
 
   def noteable
-    @noteable ||= notes_finder.target || render_404
+    @noteable ||= notes_finder.target || @note&.noteable
+  end
+
+  def require_noteable!
+    render_404 unless noteable
   end
 
   def last_fetched_at

app/controllers/snippets/notes_controller.rb

@@ -20,6 +20,7 @@ class Snippets::NotesController < ApplicationController
   def snippet
     PersonalSnippet.find_by(id: params[:snippet_id])
   end
+  alias_method :noteable, :snippet
 
   def note_params
     super.merge(noteable_id: params[:snippet_id])

changelogs/unreleased/dm-notes-actions-noteable-for-update.yml

+---
+title: Make sure NotesActions#noteable returns a Noteable in the update action
+merge_request:
+author:
+type: fixed

spec/controllers/projects/notes_controller_spec.rb

@@ -336,6 +336,29 @@ describe Projects::NotesController do
     end
   end
 
+  describe 'PUT update' do
+    let(:request_params) do
+      {
+        namespace_id: project.namespace,
+        project_id: project,
+        id: note,
+        format: :json,
+        note: {
+          note: "New comment"
+        }
+      }
+    end
+
+    before do
+      sign_in(note.author)
+      project.team << [note.author, :developer]
+    end
+
+    it "updates the note" do
+      expect { put :update, request_params }.to change { note.reload.note }
+    end
+  end
+
   describe 'DELETE destroy' do
     let(:request_params) do
       {