Fix internal snippets can be searched by anyone

parent 1d9bbb0b
...@@ -135,7 +135,10 @@ class Snippet < ActiveRecord::Base ...@@ -135,7 +135,10 @@ class Snippet < ActiveRecord::Base
end end
def accessible_to(user) def accessible_to(user)
where('visibility_level IN (?) OR author_id = ?', [Snippet::INTERNAL, Snippet::PUBLIC], user) visibility_levels = [Snippet::PUBLIC]
visibility_levels << Snippet::INTERNAL if user
where('visibility_level IN (?) OR author_id = ?', visibility_levels, user)
end end
end end
end end
...@@ -72,7 +72,7 @@ describe Snippet, models: true do ...@@ -72,7 +72,7 @@ describe Snippet, models: true do
end end
end end
describe '#search_code' do describe '.search_code' do
let(:snippet) { create(:snippet, content: 'class Foo; end') } let(:snippet) { create(:snippet, content: 'class Foo; end') }
it 'returns snippets with matching content' do it 'returns snippets with matching content' do
...@@ -88,6 +88,26 @@ describe Snippet, models: true do ...@@ -88,6 +88,26 @@ describe Snippet, models: true do
end end
end end
describe '.accessible_to' do
let(:author) { create(:author) }
let(:user) { create(:user) }
let!(:public_snippet) { create(:snippet, :public) }
let!(:internal_snippet) { create(:snippet, :internal) }
let!(:private_snippet) { create(:snippet, :private, author: author) }
it 'returns only public snippets when user is nil' do
expect(described_class.accessible_to(nil)).to eq [public_snippet]
end
it 'returns only public, and internal snippets when user is not nil' do
expect(described_class.accessible_to(user)).to match_array [public_snippet, internal_snippet]
end
it 'returns snippets where the user is the author' do
expect(described_class.accessible_to(author)).to match_array [public_snippet, internal_snippet, private_snippet]
end
end
describe '#participants' do describe '#participants' do
let(:project) { create(:project, :public) } let(:project) { create(:project, :public) }
let(:snippet) { create(:snippet, content: 'foo', project: project) } let(:snippet) { create(:snippet, content: 'foo', project: project) }
......
require 'spec_helper'
describe Search::SnippetService, services: true do
let(:author) { create(:author) }
let(:internal_user) { create(:user) }
let!(:public_snippet) { create(:snippet, :public, content: 'password: XXX') }
let!(:internal_snippet) { create(:snippet, :internal, content: 'password: XXX') }
let!(:private_snippet) { create(:snippet, :private, content: 'password: XXX', author: author) }
describe '#execute' do
context 'unauthenticated' do
it 'should return public snippets only' do
search = described_class.new(nil, search: 'password')
results = search.execute
expect(results.objects('snippet_blobs')).to match_array [public_snippet]
end
end
context 'authenticated' do
it 'should return only public & internal snippets' do
search = described_class.new(internal_user, search: 'password')
results = search.execute
expect(results.objects('snippet_blobs')).to match_array [public_snippet, internal_snippet]
end
it 'should return public, internal and private snippets for author' do
search = described_class.new(author, search: 'password')
results = search.execute
expect(results.objects('snippet_blobs')).to match_array [public_snippet, internal_snippet, private_snippet]
end
end
end
end
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment