Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
G
gitlab-ce
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
1
Merge Requests
1
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
nexedi
gitlab-ce
Commits
43d8bdb4
Commit
43d8bdb4
authored
Mar 17, 2016
by
Douglas Barbosa Alexandre
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Restrict access to references for confidential issues
parent
34ee7537
Changes
10
Hide whitespace changes
Inline
Side-by-side
Showing
10 changed files
with
102 additions
and
5 deletions
+102
-5
lib/banzai/filter/issue_reference_filter.rb
lib/banzai/filter/issue_reference_filter.rb
+5
-0
spec/features/issues/new_branch_button_spec.rb
spec/features/issues/new_branch_button_spec.rb
+1
-1
spec/lib/banzai/filter/redactor_filter_spec.rb
spec/lib/banzai/filter/redactor_filter_spec.rb
+71
-1
spec/lib/gitlab/closing_issue_extractor_spec.rb
spec/lib/gitlab/closing_issue_extractor_spec.rb
+1
-0
spec/lib/gitlab/reference_extractor_spec.rb
spec/lib/gitlab/reference_extractor_spec.rb
+2
-0
spec/models/commit_spec.rb
spec/models/commit_spec.rb
+12
-1
spec/models/concerns/mentionable_spec.rb
spec/models/concerns/mentionable_spec.rb
+3
-2
spec/models/merge_request_spec.rb
spec/models/merge_request_spec.rb
+1
-0
spec/services/git_push_service_spec.rb
spec/services/git_push_service_spec.rb
+4
-0
spec/support/mentionable_shared_examples.rb
spec/support/mentionable_shared_examples.rb
+2
-0
No files found.
lib/banzai/filter/issue_reference_filter.rb
View file @
43d8bdb4
...
...
@@ -9,6 +9,11 @@ module Banzai
Issue
end
def
self
.
user_can_see_reference?
(
user
,
node
,
context
)
issue
=
Issue
.
find
(
node
.
attr
(
'data-issue'
))
rescue
nil
Ability
.
abilities
.
allowed?
(
user
,
:read_issue
,
issue
)
end
def
find_object
(
project
,
id
)
project
.
get_issue
(
id
)
end
...
...
spec/features/issues/new_branch_button_spec.rb
View file @
43d8bdb4
...
...
@@ -24,7 +24,7 @@ feature 'Start new branch from an issue', feature: true do
end
let
(
:referenced_mr
)
do
create
(
:merge_request
,
:simple
,
source_project:
project
,
target_project:
project
,
description:
"Fixes #
#{
issue
.
iid
}
"
)
description:
"Fixes #
#{
issue
.
iid
}
"
,
author:
user
)
end
before
do
...
...
spec/lib/banzai/filter/redactor_filter_spec.rb
View file @
43d8bdb4
...
...
@@ -44,8 +44,78 @@ describe Banzai::Filter::RedactorFilter, lib: true do
end
end
context
"for user references"
do
context
'with data-issue'
do
context
'for confidential issues'
do
it
'removes references for non project members'
do
non_member
=
create
(
:user
)
project
=
create
(
:empty_project
,
:public
)
issue
=
create
(
:issue
,
:confidential
,
project:
project
)
link
=
reference_link
(
project:
project
.
id
,
issue:
issue
.
id
,
reference_filter:
'IssueReferenceFilter'
)
doc
=
filter
(
link
,
current_user:
non_member
)
expect
(
doc
.
css
(
'a'
).
length
).
to
eq
0
end
it
'allows references for author'
do
author
=
create
(
:user
)
project
=
create
(
:empty_project
,
:public
)
issue
=
create
(
:issue
,
:confidential
,
project:
project
,
author:
author
)
link
=
reference_link
(
project:
project
.
id
,
issue:
issue
.
id
,
reference_filter:
'IssueReferenceFilter'
)
doc
=
filter
(
link
,
current_user:
author
)
expect
(
doc
.
css
(
'a'
).
length
).
to
eq
1
end
it
'allows references for assignee'
do
assignee
=
create
(
:user
)
project
=
create
(
:empty_project
,
:public
)
issue
=
create
(
:issue
,
:confidential
,
project:
project
,
assignee:
assignee
)
link
=
reference_link
(
project:
project
.
id
,
issue:
issue
.
id
,
reference_filter:
'IssueReferenceFilter'
)
doc
=
filter
(
link
,
current_user:
assignee
)
expect
(
doc
.
css
(
'a'
).
length
).
to
eq
1
end
it
'allows references for project members'
do
member
=
create
(
:user
)
project
=
create
(
:empty_project
,
:public
)
project
.
team
<<
[
member
,
:developer
]
issue
=
create
(
:issue
,
:confidential
,
project:
project
)
link
=
reference_link
(
project:
project
.
id
,
issue:
issue
.
id
,
reference_filter:
'IssueReferenceFilter'
)
doc
=
filter
(
link
,
current_user:
member
)
expect
(
doc
.
css
(
'a'
).
length
).
to
eq
1
end
it
'allows references for admin'
do
admin
=
create
(
:admin
)
project
=
create
(
:empty_project
,
:public
)
issue
=
create
(
:issue
,
:confidential
,
project:
project
)
link
=
reference_link
(
project:
project
.
id
,
issue:
issue
.
id
,
reference_filter:
'IssueReferenceFilter'
)
doc
=
filter
(
link
,
current_user:
admin
)
expect
(
doc
.
css
(
'a'
).
length
).
to
eq
1
end
end
it
'allows references for non confidential issues'
do
user
=
create
(
:user
)
project
=
create
(
:empty_project
,
:public
)
issue
=
create
(
:issue
,
project:
project
)
link
=
reference_link
(
project:
project
.
id
,
issue:
issue
.
id
,
reference_filter:
'IssueReferenceFilter'
)
doc
=
filter
(
link
,
current_user:
user
)
expect
(
doc
.
css
(
'a'
).
length
).
to
eq
1
end
end
context
"for user references"
do
context
'with data-group'
do
it
'removes unpermitted Group references'
do
user
=
create
(
:user
)
...
...
spec/lib/gitlab/closing_issue_extractor_spec.rb
View file @
43d8bdb4
...
...
@@ -11,6 +11,7 @@ describe Gitlab::ClosingIssueExtractor, lib: true do
subject
{
described_class
.
new
(
project
,
project
.
creator
)
}
before
do
project
.
team
<<
[
project
.
creator
,
:developer
]
project2
.
team
<<
[
project
.
creator
,
:master
]
end
...
...
spec/lib/gitlab/reference_extractor_spec.rb
View file @
43d8bdb4
...
...
@@ -2,6 +2,7 @@ require 'spec_helper'
describe
Gitlab
::
ReferenceExtractor
,
lib:
true
do
let
(
:project
)
{
create
(
:project
)
}
subject
{
Gitlab
::
ReferenceExtractor
.
new
(
project
,
project
.
creator
)
}
it
'accesses valid user objects'
do
...
...
@@ -41,6 +42,7 @@ describe Gitlab::ReferenceExtractor, lib: true do
end
it
'accesses valid issue objects'
do
project
.
team
<<
[
project
.
creator
,
:developer
]
@i0
=
create
(
:issue
,
project:
project
)
@i1
=
create
(
:issue
,
project:
project
)
...
...
spec/models/commit_spec.rb
View file @
43d8bdb4
...
...
@@ -86,10 +86,21 @@ eos
let
(
:issue
)
{
create
:issue
,
project:
project
}
let
(
:other_project
)
{
create
:project
,
:public
}
let
(
:other_issue
)
{
create
:issue
,
project:
other_project
}
let
(
:commiter
)
{
create
:user
}
before
do
project
.
team
<<
[
commiter
,
:developer
]
other_project
.
team
<<
[
commiter
,
:developer
]
end
it
'detects issues that this commit is marked as closing'
do
ext_ref
=
"
#{
other_project
.
path_with_namespace
}
#
#{
other_issue
.
iid
}
"
allow
(
commit
).
to
receive
(
:safe_message
).
and_return
(
"Fixes #
#{
issue
.
iid
}
and
#{
ext_ref
}
"
)
allow
(
commit
).
to
receive_messages
(
safe_message:
"Fixes #
#{
issue
.
iid
}
and
#{
ext_ref
}
"
,
committer_email:
commiter
.
email
)
expect
(
commit
.
closes_issues
).
to
include
(
issue
)
expect
(
commit
.
closes_issues
).
to
include
(
other_issue
)
end
...
...
spec/models/concerns/mentionable_spec.rb
View file @
43d8bdb4
...
...
@@ -48,7 +48,8 @@ describe Issue, "Mentionable" do
describe
'#create_new_cross_references!'
do
let
(
:project
)
{
create
(
:project
)
}
let
(
:issues
)
{
create_list
(
:issue
,
2
,
project:
project
)
}
let
(
:author
)
{
create
(
:author
)
}
let
(
:issues
)
{
create_list
(
:issue
,
2
,
project:
project
,
author:
author
)
}
context
'before changes are persisted'
do
it
'ignores pre-existing references'
do
...
...
@@ -91,7 +92,7 @@ describe Issue, "Mentionable" do
end
def
create_issue
(
description
:)
create
(
:issue
,
project:
project
,
description:
description
)
create
(
:issue
,
project:
project
,
description:
description
,
author:
author
)
end
end
end
spec/models/merge_request_spec.rb
View file @
43d8bdb4
...
...
@@ -150,6 +150,7 @@ describe MergeRequest, models: true do
let
(
:commit2
)
{
double
(
'commit2'
,
safe_message:
"Fixes
#{
issue1
.
to_reference
}
"
)
}
before
do
subject
.
project
.
team
<<
[
subject
.
author
,
:developer
]
allow
(
subject
).
to
receive
(
:commits
).
and_return
([
commit0
,
commit1
,
commit2
])
end
...
...
spec/services/git_push_service_spec.rb
View file @
43d8bdb4
...
...
@@ -215,12 +215,16 @@ describe GitPushService, services: true do
let
(
:commit
)
{
project
.
commit
}
before
do
project
.
team
<<
[
commit_author
,
:developer
]
project
.
team
<<
[
user
,
:developer
]
allow
(
commit
).
to
receive_messages
(
safe_message:
"this commit
\n
mentions
#{
issue
.
to_reference
}
"
,
references:
[
issue
],
author_name:
commit_author
.
name
,
author_email:
commit_author
.
email
)
allow
(
project
.
repository
).
to
receive
(
:commits_between
).
and_return
([
commit
])
end
...
...
spec/support/mentionable_shared_examples.rb
View file @
43d8bdb4
...
...
@@ -52,6 +52,8 @@ shared_context 'mentionable context' do
end
set_mentionable_text
.
call
(
ref_string
)
project
.
team
<<
[
author
,
:developer
]
end
end
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment