Merge branch '51998-hide-personal-access-tokens-from-fellow-maintainers' into 'master'

Hide github access token in repository settings

See merge request gitlab-org/gitlab-ee!9381

ee/app/views/projects/mirrors/_table_pull_row.html.haml

@@ -3,7 +3,7 @@
 - import_state = @project.import_state
 
 %tr
-  %td= @project.username_only_import_url
+  %td.mirror-url= @project.safe_import_url
   %td= _('Pull')
   %td= import_state.last_update_at.present? ? time_ago_with_tooltip(import_state.last_update_at) : _('Never')
   %td

ee/changelogs/unreleased/51998-hide-personal-access-tokens-from-fellow-maintainers.yml

+---
+title: Hide personal access tokens from other maintainers
+merge_request:
+author:
+type: security

ee/spec/features/projects/settings/ee/repository_mirrors_settings_spec.rb

@@ -29,9 +29,11 @@ describe 'Project settings > [EE] repository' do
   end
 
   context 'licensed' do
-    it 'shows pull mirror settings', :js do
+    before do
       stub_licensed_features(repository_mirrors: true)
+    end
 
+    it 'shows pull mirror settings', :js do
       visit project_settings_repository_path(project)
 
       page.within('.project-mirror-settings') do
@@ -43,5 +45,26 @@ describe 'Project settings > [EE] repository' do
         expect(page).to have_selector('#project_mirror_trigger_builds')
       end
     end
+
+    context 'mirrored external repo', :js do
+      let(:personal_access_token) { '461171575b95eeb61fba5face8ab838853d0121f' }
+      let(:external_project) do
+        create(:project_empty_repo,
+               :mirror,
+               import_url: "https://#{personal_access_token}@github.com/testngalog2/newrepository.git")
+      end
+
+      before do
+        external_project.add_maintainer(user)
+        visit project_settings_repository_path(external_project)
+      end
+
+      it 'does not show personal access token' do
+        mirror_url = find('.mirror-url').text
+
+        expect(mirror_url).not_to include(personal_access_token)
+        expect(mirror_url).to include('https://*****@github.com/')
+      end
+    end
   end
 end