Merge branch 'security-64938-dont-disclose-path-ee' into 'master'

Redirect user to root path after unsubscribing from private resource

See merge request gitlab/gitlab-ee!1293

app/controllers/sent_notifications_controller.rb

@@ -19,7 +19,11 @@ class SentNotificationsController < ApplicationController
     flash[:notice] = _("You have been unsubscribed from this thread.")
 
     if current_user
-      redirect_to noteable_path(noteable)
+      if current_user.can?(:"read_#{noteable.class.to_ability_name}", noteable)
+        redirect_to noteable_path(noteable)
+      else
+        redirect_to root_path
+      end
     else
       redirect_to new_user_session_path
     end

changelogs/unreleased/security-64938-dont-disclose-path.yml

+---
+title: Fix new project path being disclosed through unsubscribe link of issue/merge
+  requests
+merge_request:
+author:
+type: security

ee/spec/controllers/ee/sent_notifications_controller_spec.rb

@@ -14,6 +14,7 @@ describe SentNotificationsController do
     let(:sent_notification) { create(:sent_notification, project: nil, noteable: epic, recipient: user) }
 
     before do
+      stub_licensed_features(epics: true)
       sign_in(user)
       get(:unsubscribe, params: { id: sent_notification.reply_key })
     end

spec/controllers/sent_notifications_controller_spec.rb

@@ -208,6 +208,35 @@ describe SentNotificationsController do
             .to redirect_to(project_merge_request_path(project, merge_request))
         end
       end
+
+      context 'when project is private' do
+        context 'and user does not have access' do
+          let(:noteable) { issue }
+          let(:target_project) { private_project }
+
+          before do
+            get(:unsubscribe, params: { id: sent_notification.reply_key })
+          end
+
+          it 'unsubscribes user and redirects to root path' do
+            expect(response).to redirect_to(root_path)
+          end
+        end
+
+        context 'and user has access' do
+          let(:noteable) { issue }
+          let(:target_project) { private_project }
+
+          before do
+            private_project.add_developer(user)
+            get(:unsubscribe, params: { id: sent_notification.reply_key })
+          end
+
+          it 'unsubscribes user and redirects to issue path' do
+            expect(response).to redirect_to(project_issue_path(private_project, issue))
+          end
+        end
+      end
     end
   end
 end