Merge branch '19965-access-to-git-lfs-objects-improper-access-control' into 'master'

Show object access warning when disabling repo LFS

See merge request gitlab-org/gitlab!26696

app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue

 <script>
+import { GlSprintf, GlLink } from '@gitlab/ui';
+
 import settingsMixin from 'ee_else_ce/pages/projects/shared/permissions/mixins/settings_pannel_mixin';
 import { s__ } from '~/locale';
 import projectFeatureSetting from './project_feature_setting.vue';
@@ -19,6 +21,8 @@ export default {
     projectFeatureSetting,
     projectFeatureToggle,
     projectSettingRow,
+    GlSprintf,
+    GlLink,
   },
   mixins: [settingsMixin],
 
@@ -67,6 +71,16 @@ export default {
       required: false,
       default: '',
     },
+    lfsObjectsExist: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    lfsObjectsRemovalHelpPath: {
+      type: String,
+      required: false,
+      default: '',
+    },
     registryHelpPath: {
       type: String,
       required: false,
@@ -377,6 +391,23 @@ export default {
             :disabled-input="!repositoryEnabled"
             name="project[lfs_enabled]"
           />
+          <p v-if="!lfsEnabled && lfsObjectsExist">
+            <gl-sprintf
+              :message="
+                s__(
+                  'ProjectSettings|LFS objects from this repository are still available to forks. %{linkStart}How do I remove them?%{linkEnd}',
+                )
+              "
+            >
+              <template #link="{ content }">
+                <span class="d-block">
+                  <gl-link :href="lfsObjectsRemovalHelpPath" target="_blank">
+                    {{ content }}
+                  </gl-link>
+                </span>
+              </template>
+            </gl-sprintf>
+          </p>
         </project-setting-row>
         <project-setting-row
           v-if="packagesAvailable"

app/helpers/projects_helper.rb

@@ -603,6 +603,8 @@ module ProjectsHelper
       registryHelpPath: help_page_path('user/packages/container_registry/index'),
       lfsAvailable: Gitlab.config.lfs.enabled,
       lfsHelpPath: help_page_path('workflow/lfs/manage_large_binaries_with_git_lfs'),
+      lfsObjectsExist: project.lfs_objects.exists?,
+      lfsObjectsRemovalHelpPath: help_page_path('administration/lfs/manage_large_binaries_with_git_lfs', anchor: 'removing-objects-from-lfs'),
       pagesAvailable: Gitlab.config.pages.enabled,
       pagesAccessControlEnabled: Gitlab.config.pages.access_control,
       pagesAccessControlForced: ::Gitlab::Pages.access_control_is_forced?,

changelogs/unreleased/improve-lfs-toggle-message.yml

+---
+title: Show object access warning when disabling repo LFS
+merge_request: 26696
+author:
+type: other

doc/administration/lfs/manage_large_binaries_with_git_lfs.md

@@ -93,6 +93,13 @@ git lfs fetch origin master
 
 Read the documentation on how to [migrate an existing Git repo with Git LFS](../../topics/git/migrate_to_git_lfs/index.md).
 
+### Removing objects from LFS
+
+To remove objects from LFS:
+
+1. Use [BFG-Cleaner](../../user/project/repository/reducing_the_repo_size_using_git.md#using-the-bfg-repo-cleaner) or [filter-branch](../../user/project/repository/reducing_the_repo_size_using_git.md#using-git-filter-branch) to remove the objects from the repository.
+1. Delete the relevant LFS lines for the objects you have removed from your `.gitattributes` file and commit those changes.
+
 ## File Locking
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/issues/35856) in GitLab 10.5.

doc/topics/git/index.md

@@ -85,6 +85,7 @@ The following relate to Git Large File Storage:
 
 - [Getting Started with Git LFS](https://about.gitlab.com/blog/2017/01/30/getting-started-with-git-lfs-tutorial/)
 - [Migrate an existing Git repo with Git LFS](migrate_to_git_lfs/index.md)
+- [Removing objects from LFS](../../administration/lfs/manage_large_binaries_with_git_lfs.md#removing-objects-from-lfs)
 - [GitLab Git LFS user documentation](../../administration/lfs/manage_large_binaries_with_git_lfs.md)
 - [GitLab Git LFS admin documentation](../../administration/lfs/lfs_administration.md)
 - [git-annex to Git-LFS migration guide](../../administration/lfs/migrate_from_git_annex_to_git_lfs.md)

locale/gitlab.pot

@@ -15552,6 +15552,9 @@ msgstr ""
 msgid "ProjectSettings|Issues"
 msgstr ""
 
+msgid "ProjectSettings|LFS objects from this repository are still available to forks. %{linkStart}How do I remove them?%{linkEnd}"
+msgstr ""
+
 msgid "ProjectSettings|Learn more about badges."
 msgstr ""
 

spec/frontend/pages/projects/shared/permissions/components/settings_panel_spec.js

-import { shallowMount } from '@vue/test-utils';
+import { shallowMount, mount } from '@vue/test-utils';
 
 import settingsPanel from '~/pages/projects/shared/permissions/components/settings_panel.vue';
 import {
@@ -32,6 +32,8 @@ const defaultProps = {
   registryHelpPath: '/help/user/packages/container_registry/index',
   lfsAvailable: true,
   lfsHelpPath: '/help/workflow/lfs/manage_large_binaries_with_git_lfs',
+  lfsObjectsExist: false,
+  lfsObjectsRemovalHelpPath: `/help/administration/lfs/manage_large_binaries_with_git_lfs#removing-objects-from-lfs`,
   pagesAvailable: true,
   pagesAccessControlEnabled: false,
   pagesAccessControlForced: false,
@@ -43,21 +45,25 @@ const defaultProps = {
 describe('Settings Panel', () => {
   let wrapper;
 
-  const mountComponent = customProps => {
-    const propsData = { ...defaultProps, ...customProps };
-    return shallowMount(settingsPanel, { propsData });
+  const mountComponent = (
+    { currentSettings = {}, ...customProps } = {},
+    mountFn = shallowMount,
+  ) => {
+    const propsData = {
+      ...defaultProps,
+      ...customProps,
+      currentSettings: { ...defaultProps.currentSettings, ...currentSettings },
+    };
+
+    return mountFn(settingsPanel, { propsData });
   };
 
   const overrideCurrentSettings = (currentSettingsProps, extraProps = {}) => {
-    return mountComponent({
-      ...extraProps,
-      currentSettings: {
-        ...defaultProps.currentSettings,
-        ...currentSettingsProps,
-      },
-    });
+    return mountComponent({ ...extraProps, currentSettings: currentSettingsProps });
   };
 
+  const findLFSSettingsMessage = () => wrapper.find({ ref: 'git-lfs-settings' }).find('p');
+
   beforeEach(() => {
     wrapper = mountComponent();
   });
@@ -333,6 +339,40 @@ describe('Settings Panel', () => {
 
       expect(wrapper.find('[name="project[lfs_enabled]"]').props().disabledInput).toEqual(true);
     });
+
+    describe.each`
+      lfsObjectsExist | lfsEnabled | isShown
+      ${true}         | ${true}    | ${false}
+      ${true}         | ${false}   | ${true}
+      ${false}        | ${true}    | ${false}
+      ${false}        | ${false}   | ${false}
+    `(
+      'with (lfsObjectsExist = $lfsObjectsExist, lfsEnabled = $lfsEnabled)',
+      ({ lfsObjectsExist, lfsEnabled, isShown }) => {
+        beforeEach(() => {
+          wrapper = mountComponent({ lfsObjectsExist, currentSettings: { lfsEnabled } }, mount);
+        });
+
+        if (isShown) {
+          it('shows warning message', () => {
+            const message = findLFSSettingsMessage();
+            const link = message.find('a');
+
+            expect(message.text()).toContain(
+              'LFS objects from this repository are still available to forks',
+            );
+            expect(link.text()).toEqual('How do I remove them?');
+            expect(link.attributes('href')).toEqual(
+              '/help/administration/lfs/manage_large_binaries_with_git_lfs#removing-objects-from-lfs',
+            );
+          });
+        } else {
+          it('does not show warning message', () => {
+            expect(findLFSSettingsMessage().exists()).toEqual(false);
+          });
+        }
+      },
+    );
   });
 
   describe('Packages', () => {