Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
G
gitlab-ce
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
1
Merge Requests
1
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
nexedi
gitlab-ce
Commits
4d7f9351
Commit
4d7f9351
authored
Dec 19, 2018
by
Grzegorz Bizon
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Do not expose trigger token when user should not see it
parent
7a10ef6e
Changes
8
Hide whitespace changes
Inline
Side-by-side
Showing
8 changed files
with
68 additions
and
13 deletions
+68
-13
app/controllers/projects/triggers_controller.rb
app/controllers/projects/triggers_controller.rb
+3
-4
app/models/ci/trigger.rb
app/models/ci/trigger.rb
+1
-0
app/presenters/ci/trigger_presenter.rb
app/presenters/ci/trigger_presenter.rb
+19
-0
app/views/projects/triggers/_trigger.html.haml
app/views/projects/triggers/_trigger.html.haml
+1
-1
lib/api/entities.rb
lib/api/entities.rb
+4
-1
lib/api/helpers/presentable.rb
lib/api/helpers/presentable.rb
+29
-0
lib/api/triggers.rb
lib/api/triggers.rb
+2
-2
spec/requests/api/triggers_spec.rb
spec/requests/api/triggers_spec.rb
+9
-5
No files found.
app/controllers/projects/triggers_controller.rb
View file @
4d7f9351
...
...
@@ -66,12 +66,11 @@ class Projects::TriggersController < Projects::ApplicationController
end
def
trigger
@trigger
||=
project
.
triggers
.
find
(
params
[
:id
])
||
render_404
@trigger
||=
project
.
triggers
.
find
(
params
[
:id
])
.
present
(
current_user:
current_user
)
end
def
trigger_params
params
.
require
(
:trigger
).
permit
(
:description
)
params
.
require
(
:trigger
).
permit
(
:description
)
end
end
app/models/ci/trigger.rb
View file @
4d7f9351
...
...
@@ -4,6 +4,7 @@ module Ci
class
Trigger
<
ActiveRecord
::
Base
extend
Gitlab
::
Ci
::
Model
include
IgnorableColumn
include
Presentable
ignore_column
:deleted_at
...
...
app/presenters/ci/trigger_presenter.rb
0 → 100644
View file @
4d7f9351
# frozen_string_literal: true
module
Ci
class
TriggerPresenter
<
Gitlab
::
View
::
Presenter
::
Delegated
presents
:trigger
def
has_token_exposed?
can?
(
current_user
,
:admin_trigger
,
trigger
)
end
def
token
if
has_token_exposed?
trigger
.
token
else
trigger
.
short_token
end
end
end
end
app/views/projects/triggers/_trigger.html.haml
View file @
4d7f9351
%tr
%td
-
if
can?
(
current_user
,
:admin_trigger
,
trigger
)
-
if
trigger
.
has_token_exposed?
%span
=
trigger
.
token
=
clipboard_button
(
text:
trigger
.
token
,
title:
"Copy trigger token to clipboard"
)
-
else
...
...
lib/api/entities.rb
View file @
4d7f9351
...
...
@@ -1216,8 +1216,11 @@ module API
end
class
Trigger
<
Grape
::
Entity
include
::
API
::
Helpers
::
Presentable
expose
:id
expose
:token
,
:description
expose
:token
expose
:description
expose
:created_at
,
:updated_at
,
:last_used
expose
:owner
,
using:
Entities
::
UserBasic
end
...
...
lib/api/helpers/presentable.rb
0 → 100644
View file @
4d7f9351
# frozen_string_literal: true
module
API
module
Helpers
##
# This module makes it possible to use `app/presenters` with
# Grape Entities. It instantiates model presenter and passes
# options defined in the API endpoint to the presenter itself.
#
# present object, with: Entities::Something,
# current_user: current_user,
# another_option: 'my options'
#
# Example above will make `current_user` and `another_option`
# values available in the subclass of `Gitlab::View::Presenter`
# thorough a separate method in the presenter.
#
# The model class needs to have `::Presentable` module mixed in
# if you want to use `API::Helpers::Presentable`.
#
module
Presentable
extend
ActiveSupport
::
Concern
def
initialize
(
object
,
options
=
{})
super
(
object
.
present
(
options
),
options
)
end
end
end
end
lib/api/triggers.rb
View file @
4d7f9351
...
...
@@ -51,7 +51,7 @@ module API
triggers
=
user_project
.
triggers
.
includes
(
:trigger_requests
)
present
paginate
(
triggers
),
with:
Entities
::
Trigger
present
paginate
(
triggers
),
with:
Entities
::
Trigger
,
current_user:
current_user
end
# rubocop: enable CodeReuse/ActiveRecord
...
...
@@ -68,7 +68,7 @@ module API
trigger
=
user_project
.
triggers
.
find
(
params
.
delete
(
:trigger_id
))
break
not_found!
(
'Trigger'
)
unless
trigger
present
trigger
,
with:
Entities
::
Trigger
present
trigger
,
with:
Entities
::
Trigger
,
current_user:
current_user
end
desc
'Create a trigger'
do
...
...
spec/requests/api/triggers_spec.rb
View file @
4d7f9351
require
'spec_helper'
describe
API
::
Triggers
do
let
(
:user
)
{
create
(
:user
)
}
let
(
:user2
)
{
create
(
:user
)
}
set
(
:user
)
{
create
(
:user
)
}
set
(
:user2
)
{
create
(
:user
)
}
let!
(
:trigger_token
)
{
'secure_token'
}
let!
(
:trigger_token_2
)
{
'secure_token_2'
}
let!
(
:project
)
{
create
(
:project
,
:repository
,
creator:
user
)
}
...
...
@@ -132,14 +133,17 @@ describe API::Triggers do
end
describe
'GET /projects/:id/triggers'
do
context
'authenticated user w
ith valid permission
s'
do
it
'returns
list of triggers
'
do
context
'authenticated user w
ho can access trigger
s'
do
it
'returns
a list of triggers with tokens exposed correctly
'
do
get
api
(
"/projects/
#{
project
.
id
}
/triggers"
,
user
)
expect
(
response
).
to
have_gitlab_http_status
(
200
)
expect
(
response
).
to
include_pagination_headers
expect
(
json_response
).
to
be_a
(
Array
)
expect
(
json_response
[
0
]).
to
have_key
(
'token'
)
expect
(
json_response
.
size
).
to
eq
2
expect
(
json_response
.
dig
(
0
,
'token'
)).
to
eq
trigger_token
expect
(
json_response
.
dig
(
1
,
'token'
)).
to
eq
trigger_token_2
[
0
..
3
]
end
end
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment