• Douwe Maan's avatar
    Merge branch 'explicit-requesters-scope' into 'master' · d1c94f03
    Douwe Maan authored
    Exclude requesters from Project#members, Group#members and User#members
    
    ## What does this MR do?
    
    It excludes requesters from the `Project#members`, `Group#members` and `User#members` associations, and adds new `Project#requesters` and `Group#requesters` associations.
    
    ## Are there points in the code the reviewer needs to double check?
    
    No.
    
    ## Why was this MR needed?
    
    Without this, if you call `project.members`, requesters are included in the results! This is at best misleading, and at worst can lead to security issues. By excluding requesters from the `#members` associations, we avoid introducing security inadvertently since you have to call the `#requesters` association explicitly to get requesters.
    
    ## What are the relevant issue numbers?
    
    This is something I realized while fixing the security issue #19102.
    
    ## Does this MR meet the acceptance criteria?
    
    - [x] I don't think this needs a CHANGELOG since this is an internal change
    - Tests
      - [x] Added for this feature/bug
      - [ ] All builds are passing
    - [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
    - [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
    - [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)
    
    See merge request !4946
    d1c94f03
notify_spec.rb 42.4 KB