Commit 0058c97a authored by John Jarvis's avatar John Jarvis

Merge branch 'security-refs-available-to-project-guest' into 'master'

[master] Project guests no longer are able to see refs page

See merge request gitlab/gitlabhq!2685
parents e4dabec8 8772bdab
...@@ -19,6 +19,7 @@ class ProjectsController < Projects::ApplicationController ...@@ -19,6 +19,7 @@ class ProjectsController < Projects::ApplicationController
before_action :lfs_blob_ids, only: [:show], if: [:repo_exists?, :project_view_files?] before_action :lfs_blob_ids, only: [:show], if: [:repo_exists?, :project_view_files?]
before_action :project_export_enabled, only: [:export, :download_export, :remove_export, :generate_new_export] before_action :project_export_enabled, only: [:export, :download_export, :remove_export, :generate_new_export]
before_action :present_project, only: [:edit] before_action :present_project, only: [:edit]
before_action :authorize_download_code!, only: [:refs]
# Authorize # Authorize
before_action :authorize_admin_project!, only: [:edit, :update, :housekeeping, :download_export, :export, :remove_export, :generate_new_export] before_action :authorize_admin_project!, only: [:edit, :update, :housekeeping, :download_export, :export, :remove_export, :generate_new_export]
......
---
title: Project guests no longer are able to see refs page
merge_request:
author:
type: security
...@@ -621,10 +621,10 @@ describe ProjectsController do ...@@ -621,10 +621,10 @@ describe ProjectsController do
end end
describe "GET refs" do describe "GET refs" do
let(:public_project) { create(:project, :public, :repository) } let(:project) { create(:project, :public, :repository) }
it 'gets a list of branches and tags' do it 'gets a list of branches and tags' do
get :refs, params: { namespace_id: public_project.namespace, id: public_project, sort: 'updated_desc' } get :refs, params: { namespace_id: project.namespace, id: project, sort: 'updated_desc' }
parsed_body = JSON.parse(response.body) parsed_body = JSON.parse(response.body)
expect(parsed_body['Branches']).to include('master') expect(parsed_body['Branches']).to include('master')
...@@ -634,7 +634,7 @@ describe ProjectsController do ...@@ -634,7 +634,7 @@ describe ProjectsController do
end end
it "gets a list of branches, tags and commits" do it "gets a list of branches, tags and commits" do
get :refs, params: { namespace_id: public_project.namespace, id: public_project, ref: "123456" } get :refs, params: { namespace_id: project.namespace, id: project, ref: "123456" }
parsed_body = JSON.parse(response.body) parsed_body = JSON.parse(response.body)
expect(parsed_body["Branches"]).to include("master") expect(parsed_body["Branches"]).to include("master")
...@@ -649,7 +649,7 @@ describe ProjectsController do ...@@ -649,7 +649,7 @@ describe ProjectsController do
end end
it "gets a list of branches, tags and commits" do it "gets a list of branches, tags and commits" do
get :refs, params: { namespace_id: public_project.namespace, id: public_project, ref: "123456" } get :refs, params: { namespace_id: project.namespace, id: project, ref: "123456" }
parsed_body = JSON.parse(response.body) parsed_body = JSON.parse(response.body)
expect(parsed_body["Branches"]).to include("master") expect(parsed_body["Branches"]).to include("master")
...@@ -657,6 +657,22 @@ describe ProjectsController do ...@@ -657,6 +657,22 @@ describe ProjectsController do
expect(parsed_body["Commits"]).to include("123456") expect(parsed_body["Commits"]).to include("123456")
end end
end end
context 'when private project' do
let(:project) { create(:project, :repository) }
context 'as a guest' do
it 'renders forbidden' do
user = create(:user)
project.add_guest(user)
sign_in(user)
get :refs, namespace_id: project.namespace, id: project
expect(response).to have_gitlab_http_status(404)
end
end
end
end end
describe 'POST #preview_markdown' do describe 'POST #preview_markdown' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment