Merge branch 'rs-issue-13467' into 'master'

Ensure Commit#show responds 404 instead of 500 when given an invalid ID

Closes #13467

See merge request !2823

app/controllers/projects/commit_controller.rb

@@ -11,8 +11,6 @@ class Projects::CommitController < Projects::ApplicationController
   before_action :define_show_vars, only: [:show, :builds]
 
   def show
-    return git_not_found! unless @commit
-
     apply_diff_view_cookie!
 
     @line_notes = commit.notes.inline
@@ -68,6 +66,8 @@ class Projects::CommitController < Projects::ApplicationController
   end
 
   def define_show_vars
+    return git_not_found! unless commit
+
     if params[:w].to_i == 1
       @diffs = commit.diffs({ ignore_whitespace_change: true })
     else

spec/controllers/projects/commit_controller_spec.rb

+require 'rails_helper'
+
+describe Projects::CommitController do
+  describe 'GET show' do
+    let(:project) { create(:project) }
+
+    before do
+      user = create(:user)
+      project.team << [user, :master]
+
+      sign_in(user)
+    end
+
+    context 'with valid id' do
+      it 'responds with 200' do
+        go id: project.commit.id
+
+        expect(response).to be_ok
+      end
+    end
+
+    context 'with invalid id' do
+      it 'responds with 404' do
+        go id: project.commit.id.reverse
+
+        expect(response).to be_not_found
+      end
+    end
+
+    def go(id:)
+      get :show,
+        namespace_id: project.namespace.to_param,
+        project_id: project.to_param,
+        id: id
+    end
+  end
+end