Commit 4efd18d7 authored by Kamil Trzciński's avatar Kamil Trzciński Committed by Robert Speicher

Merge branch '29943-environment-folder' into 'security-9-5'

Do not use `location.pathname` when accessing environments folders

See merge request !2147
parent 4acab552
......@@ -111,11 +111,11 @@ export default {
},
methods: {
toggleFolder(folder, folderUrl) {
toggleFolder(folder) {
this.store.toggleFolder(folder);
if (!folder.isOpen) {
this.fetchChildEnvironments(folder, folderUrl, true);
this.fetchChildEnvironments(folder, true);
}
},
......@@ -143,10 +143,10 @@ export default {
.catch(this.errorCallback);
},
fetchChildEnvironments(folder, folderUrl, showLoader = false) {
fetchChildEnvironments(folder, showLoader = false) {
this.store.updateEnvironmentProp(folder, 'isLoadingFolderContent', showLoader);
this.service.getFolderContent(folderUrl)
this.service.getFolderContent(folder.folder_path)
.then(resp => resp.json())
.then(response => this.store.setfolderContent(folder, response.environments))
.then(() => this.store.updateEnvironmentProp(folder, 'isLoadingFolderContent', false))
......@@ -173,12 +173,7 @@ export default {
// We need to verify if any folder is open to also update it
const openFolders = this.store.getOpenFolders();
if (openFolders.length) {
openFolders.forEach((folder) => {
// TODO - Move this to the backend
const folderUrl = `${window.location.pathname}/folders/${folder.folderName}`;
return this.fetchChildEnvironments(folder, folderUrl);
});
openFolders.forEach(folder => this.fetchChildEnvironments(folder));
}
},
......
......@@ -410,20 +410,11 @@ export default {
this.hasStopAction ||
this.canRetry;
},
/**
* Constructs folder URL based on the current location and the folder id.
*
* @return {String}
*/
folderUrl() {
return `${window.location.pathname}/folders/${this.model.folderName}`;
},
},
methods: {
onClickFolder() {
eventHub.$emit('toggleFolder', this.model, this.folderUrl);
eventHub.$emit('toggleFolder', this.model);
},
},
};
......
......@@ -82,12 +82,7 @@ class Environment < ActiveRecord::Base
def set_environment_type
names = name.split('/')
self.environment_type =
if names.many?
names.first
else
nil
end
self.environment_type = names.many? ? names.first : nil
end
def includes_commit?(commit)
......@@ -101,7 +96,7 @@ class Environment < ActiveRecord::Base
end
def update_merge_request_metrics?
(environment_type || name) == "production"
folder_name == "production"
end
def first_deployment_for(commit)
......@@ -223,6 +218,10 @@ class Environment < ActiveRecord::Base
format: :json)
end
def folder_name
self.environment_type || self.name
end
private
# Slugifying a name may remove the uniqueness guarantee afforded by it being
......
......@@ -26,5 +26,9 @@ class EnvironmentEntity < Grape::Entity
terminal_project_environment_path(environment.project, environment)
end
expose :folder_path do |environment|
folder_project_environments_path(environment.project, environment.folder_name)
end
expose :created_at, :updated_at
end
......@@ -36,9 +36,9 @@ class EnvironmentSerializer < BaseSerializer
private
def itemize(resource)
items = resource.order('folder_name ASC')
items = resource.order('folder ASC')
.group('COALESCE(environment_type, name)')
.select('COALESCE(environment_type, name) AS folder_name',
.select('COALESCE(environment_type, name) AS folder',
'COUNT(*) AS size', 'MAX(id) AS last_id')
# It makes a difference when you call `paginate` method, because
......@@ -49,7 +49,7 @@ class EnvironmentSerializer < BaseSerializer
environments = resource.where(id: items.map(&:last_id)).index_by(&:id)
items.map do |item|
Item.new(item.folder_name, item.size, environments[item.last_id])
Item.new(item.folder, item.size, environments[item.last_id])
end
end
end
---
title: Resolve CSRF token leakage via pathname manipulation on environments page
merge_request:
author:
......@@ -54,6 +54,28 @@ describe Environment do
end
end
describe '#folder_name' do
context 'when it is inside a folder' do
subject(:environment) do
create(:environment, name: 'staging/review-1')
end
it 'returns a top-level folder name' do
expect(environment.folder_name).to eq 'staging'
end
end
context 'when the environment if a top-level item itself' do
subject(:environment) do
create(:environment, name: 'production')
end
it 'returns an environment name' do
expect(environment.folder_name).to eq 'production'
end
end
end
describe '#nullify_external_url' do
it 'replaces a blank url with nil' do
env = build(:environment, external_url: "")
......
......@@ -16,6 +16,10 @@ describe EnvironmentEntity do
expect(subject).to include(:id, :name, :state, :environment_path)
end
it 'exposes folder path' do
expect(subject).to include(:folder_path)
end
context 'metrics disabled' do
before do
allow(environment).to receive(:has_metrics?).and_return(false)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment