Merge branch 'sh-fix-group-rename-deletion' into 'master'

Prevent accidental group deletion if path rename fails

See merge request gitlab-org/gitlab!40353

app/controllers/groups_controller.rb

@@ -123,7 +123,7 @@ class GroupsController < Groups::ApplicationController
     if Groups::UpdateService.new(@group, current_user, group_params).execute
       redirect_to edit_group_path(@group, anchor: params[:update_section]), notice: "Group '#{@group.name}' was successfully updated."
     else
-      @group.path = @group.path_before_last_save || @group.path_was
+      @group.reset
       render action: "edit"
     end
   end

changelogs/unreleased/security-group-rename-deletion.yml

+---
+title: Prevent accidental group deletion if path rename fails
+merge_request: 40353
+author:
+type: fixed

spec/controllers/groups_controller_spec.rb

@@ -555,6 +555,21 @@ RSpec.describe GroupsController do
       end
     end
 
+    context 'when there is a conflicting group path' do
+      render_views
+
+      let!(:conflict_group) { create(:group, path: SecureRandom.hex(12) ) }
+      let!(:old_name) { group.name }
+
+      it 'does not render references to the conflicting group' do
+        put :update, params: { id: group.to_param, group: { path: conflict_group.path } }
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(group.reload.name).to eq(old_name)
+        expect(response.body).not_to include(conflict_group.path)
+      end
+    end
+
     context 'when a project inside the group has container repositories' do
       before do
         stub_container_registry_config(enabled: true)