Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
G
gitlab-ce
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
1
Merge Requests
1
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
nexedi
gitlab-ce
Commits
d4c26a1d
Commit
d4c26a1d
authored
Jun 03, 2020
by
GitLab Release Tools Bot
Browse files
Options
Browse Files
Download
Plain Diff
Merge remote-tracking branch 'dev/12-10-stable' into 12-10-stable
parents
086a9faa
2ae60e40
Changes
5
Hide whitespace changes
Inline
Side-by-side
Showing
5 changed files
with
54 additions
and
13 deletions
+54
-13
CHANGELOG.md
CHANGELOG.md
+7
-0
GITALY_SERVER_VERSION
GITALY_SERVER_VERSION
+1
-1
VERSION
VERSION
+1
-1
app/policies/project_policy.rb
app/policies/project_policy.rb
+1
-0
spec/policies/project_policy_spec.rb
spec/policies/project_policy_spec.rb
+44
-11
No files found.
CHANGELOG.md
View file @
d4c26a1d
...
@@ -2,6 +2,13 @@
...
@@ -2,6 +2,13 @@
documentation
](
doc/development/changelog.md
)
for instructions on adding your own
documentation
](
doc/development/changelog.md
)
for instructions on adding your own
entry.
entry.
## 12.10.9 (2020-06-03)
### Security (1 change)
-
Prevent fetching repository code with unauthorized ci token.
## 12.10.8 (2020-05-28)
## 12.10.8 (2020-05-28)
### Fixed (2 changes)
### Fixed (2 changes)
...
...
GITALY_SERVER_VERSION
View file @
d4c26a1d
12.10.
8
12.10.
9
VERSION
View file @
d4c26a1d
12.10.
8
12.10.
9
app/policies/project_policy.rb
View file @
d4c26a1d
...
@@ -392,6 +392,7 @@ class ProjectPolicy < BasePolicy
...
@@ -392,6 +392,7 @@ class ProjectPolicy < BasePolicy
rule
{
repository_disabled
}.
policy
do
rule
{
repository_disabled
}.
policy
do
prevent
:push_code
prevent
:push_code
prevent
:download_code
prevent
:download_code
prevent
:build_download_code
prevent
:fork_project
prevent
:fork_project
prevent
:read_commit_status
prevent
:read_commit_status
prevent
:read_pipeline
prevent
:read_pipeline
...
...
spec/policies/project_policy_spec.rb
View file @
d4c26a1d
...
@@ -5,6 +5,7 @@ require 'spec_helper'
...
@@ -5,6 +5,7 @@ require 'spec_helper'
describe
ProjectPolicy
do
describe
ProjectPolicy
do
include
ExternalAuthorizationServiceHelpers
include
ExternalAuthorizationServiceHelpers
include_context
'ProjectPolicy context'
include_context
'ProjectPolicy context'
let_it_be
(
:other_user
)
{
create
(
:user
)
}
let_it_be
(
:guest
)
{
create
(
:user
)
}
let_it_be
(
:guest
)
{
create
(
:user
)
}
let_it_be
(
:reporter
)
{
create
(
:user
)
}
let_it_be
(
:reporter
)
{
create
(
:user
)
}
let_it_be
(
:developer
)
{
create
(
:user
)
}
let_it_be
(
:developer
)
{
create
(
:user
)
}
...
@@ -161,7 +162,7 @@ describe ProjectPolicy do
...
@@ -161,7 +162,7 @@ describe ProjectPolicy do
subject
{
described_class
.
new
(
owner
,
project
)
}
subject
{
described_class
.
new
(
owner
,
project
)
}
it
'disallows all permissions when the feature is disabled'
do
it
'disallows all permissions when the feature is disabled'
do
project
.
project_feature
.
update
(
merge_requests_access_level:
ProjectFeature
::
DISABLED
)
project
.
project_feature
.
update
!
(
merge_requests_access_level:
ProjectFeature
::
DISABLED
)
mr_permissions
=
[
:create_merge_request_from
,
:read_merge_request
,
mr_permissions
=
[
:create_merge_request_from
,
:read_merge_request
,
:update_merge_request
,
:admin_merge_request
,
:update_merge_request
,
:admin_merge_request
,
...
@@ -213,7 +214,7 @@ describe ProjectPolicy do
...
@@ -213,7 +214,7 @@ describe ProjectPolicy do
subject
{
described_class
.
new
(
owner
,
project
)
}
subject
{
described_class
.
new
(
owner
,
project
)
}
before
do
before
do
project
.
project_feature
.
update
(
builds_access_level:
ProjectFeature
::
DISABLED
)
project
.
project_feature
.
update
!
(
builds_access_level:
ProjectFeature
::
DISABLED
)
end
end
it
'disallows all permissions except pipeline when the feature is disabled'
do
it
'disallows all permissions except pipeline when the feature is disabled'
do
...
@@ -233,7 +234,7 @@ describe ProjectPolicy do
...
@@ -233,7 +234,7 @@ describe ProjectPolicy do
subject
{
described_class
.
new
(
guest
,
project
)
}
subject
{
described_class
.
new
(
guest
,
project
)
}
before
do
before
do
project
.
project_feature
.
update
(
builds_access_level:
ProjectFeature
::
PRIVATE
)
project
.
project_feature
.
update
!
(
builds_access_level:
ProjectFeature
::
PRIVATE
)
end
end
it
'disallows pipeline and commit_status permissions'
do
it
'disallows pipeline and commit_status permissions'
do
...
@@ -248,22 +249,54 @@ describe ProjectPolicy do
...
@@ -248,22 +249,54 @@ describe ProjectPolicy do
end
end
context
'repository feature'
do
context
'repository feature'
do
subject
{
described_class
.
new
(
owner
,
project
)
}
let
(
:repository_permissions
)
do
[
it
'disallows all permissions when the feature is disabled'
do
project
.
project_feature
.
update
(
repository_access_level:
ProjectFeature
::
DISABLED
)
repository_permissions
=
[
:create_pipeline
,
:update_pipeline
,
:admin_pipeline
,
:destroy_pipeline
,
:create_pipeline
,
:update_pipeline
,
:admin_pipeline
,
:destroy_pipeline
,
:create_build
,
:read_build
,
:update_build
,
:admin_build
,
:destroy_build
,
:create_build
,
:read_build
,
:update_build
,
:admin_build
,
:destroy_build
,
:create_pipeline_schedule
,
:read_pipeline_schedule
,
:update_pipeline_schedule
,
:admin_pipeline_schedule
,
:destroy_pipeline_schedule
,
:create_pipeline_schedule
,
:read_pipeline_schedule
,
:update_pipeline_schedule
,
:admin_pipeline_schedule
,
:destroy_pipeline_schedule
,
:create_environment
,
:read_environment
,
:update_environment
,
:admin_environment
,
:destroy_environment
,
:create_environment
,
:read_environment
,
:update_environment
,
:admin_environment
,
:destroy_environment
,
:create_cluster
,
:read_cluster
,
:update_cluster
,
:admin_cluster
,
:create_cluster
,
:read_cluster
,
:update_cluster
,
:admin_cluster
,
:create_deployment
,
:read_deployment
,
:update_deployment
,
:admin_deployment
,
:destroy_deployment
,
:create_deployment
,
:read_deployment
,
:update_deployment
,
:admin_deployment
,
:destroy_deployment
,
:destroy_release
:destroy_release
,
:download_code
,
:build_download_code
]
]
end
context
'when user is a project member'
do
subject
{
described_class
.
new
(
owner
,
project
)
}
context
'when it is disabled'
do
before
do
project
.
project_feature
.
update!
(
repository_access_level:
ProjectFeature
::
DISABLED
,
merge_requests_access_level:
ProjectFeature
::
DISABLED
,
builds_access_level:
ProjectFeature
::
DISABLED
,
forking_access_level:
ProjectFeature
::
DISABLED
)
end
expect_disallowed
(
*
repository_permissions
)
it
'disallows all permissions'
do
expect_disallowed
(
*
repository_permissions
)
end
end
end
context
'when user is some other user'
do
subject
{
described_class
.
new
(
other_user
,
project
)
}
context
'when access level is private'
do
before
do
project
.
project_feature
.
update!
(
repository_access_level:
ProjectFeature
::
PRIVATE
,
merge_requests_access_level:
ProjectFeature
::
PRIVATE
,
builds_access_level:
ProjectFeature
::
PRIVATE
,
forking_access_level:
ProjectFeature
::
PRIVATE
)
end
it
'disallows all permissions'
do
expect_disallowed
(
*
repository_permissions
)
end
end
end
end
end
end
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment