Merge branch 'sh-fix-overwrite-import-export-check' into 'master'

Fix overwrite check in GitLab import/export

See merge request gitlab-org/gitlab!31439

app/services/projects/import_service.rb

@@ -3,6 +3,7 @@
 module Projects
   class ImportService < BaseService
     Error = Class.new(StandardError)
+    PermissionError = Class.new(StandardError)
 
     # Returns true if this importer is supposed to perform its work in the
     # background.

changelogs/unreleased/sh-fix-overwrite-import-export-check.yml

+---
+title: Fix overwrite check in GitLab import/export
+merge_request: 31439
+author:
+type: fixed

lib/gitlab/import_export/importer.rb

@@ -111,12 +111,16 @@ module Gitlab
       end
 
       def overwrite_project
-        return unless can?(current_user, :admin_namespace, project.namespace)
+        return true unless overwrite_project?
+
+        unless can?(current_user, :admin_namespace, project.namespace)
+          message = "User #{current_user&.username} (#{current_user&.id}) cannot overwrite a project in #{project.namespace.path}"
+          @shared.error(::Projects::ImportService::PermissionError.new(message))
+          return false
+        end
 
-        if overwrite_project?
         ::Projects::OverwriteProjectService.new(project, current_user)
                                             .execute(project_to_overwrite)
-        end
 
         true
       end

spec/lib/gitlab/import_export/importer_spec.rb

@@ -89,6 +89,7 @@ describe Gitlab::ImportExport::Importer do
     end
 
     context 'when project successfully restored' do
+      context "with a project in a user's namespace" do
         let!(:existing_project) { create(:project, namespace: user.namespace) }
         let(:project) { create(:project, namespace: user.namespace, name: 'whatever', path: 'whatever') }
 
@@ -104,7 +105,9 @@ describe Gitlab::ImportExport::Importer do
         context 'when import_data' do
           context 'has original_path' do
             it 'overwrites existing project' do
-            expect_any_instance_of(::Projects::OverwriteProjectService).to receive(:execute).with(existing_project)
+              expect_next_instance_of(::Projects::OverwriteProjectService) do |service|
+                expect(service).to receive(:execute).with(existing_project)
+              end
 
               subject.execute
             end
@@ -116,12 +119,47 @@ describe Gitlab::ImportExport::Importer do
             end
 
             it 'does not call the overwrite service' do
-            expect_any_instance_of(::Projects::OverwriteProjectService).not_to receive(:execute).with(existing_project)
+              expect(::Projects::OverwriteProjectService).not_to receive(:new)
 
               subject.execute
             end
           end
         end
       end
+
+      context "with a project in a group namespace" do
+        let(:group) { create(:group) }
+        let!(:existing_project) { create(:project, group: group) }
+        let(:project) { create(:project, creator: user, group: group, name: 'whatever', path: 'whatever') }
+
+        before do
+          restorers = double(:restorers, all?: true)
+
+          allow(subject).to receive(:import_file).and_return(true)
+          allow(subject).to receive(:check_version!).and_return(true)
+          allow(subject).to receive(:restorers).and_return(restorers)
+          allow(project).to receive(:import_data).and_return(double(data: { 'original_path' => existing_project.path }))
+        end
+
+        context 'has original_path' do
+          it 'overwrites existing project' do
+            group.add_owner(user)
+
+            expect_next_instance_of(::Projects::OverwriteProjectService) do |service|
+              expect(service).to receive(:execute).with(existing_project)
+            end
+
+            subject.execute
+          end
+
+          it 'does not allow user to overwrite existing project' do
+            expect(::Projects::OverwriteProjectService).not_to receive(:new)
+
+            expect { subject.execute }.to raise_error(Projects::ImportService::Error,
+              "User #{user.username} (#{user.id}) cannot overwrite a project in #{group.path}")
+          end
+        end
+      end
+    end
   end
 end