Commit f695ef55 authored by Douwe Maan's avatar Douwe Maan Committed by Bob Van Landuyt

Merge branch '31157-search-security-fix' into 'security'

Respect project features when searching alternative branches with elasticsearch enabled

See merge request !508
parent bee09952
---
title: Respect project features when searching alternative branches with elasticsearch
enabled
merge_request:
author:
...@@ -48,6 +48,8 @@ module Gitlab ...@@ -48,6 +48,8 @@ module Gitlab
private private
def blobs def blobs
return Kaminari.paginate_array([]) unless Ability.allowed?(@current_user, :download_code, project)
if project.empty_repo? || query.blank? if project.empty_repo? || query.blank?
Kaminari.paginate_array([]) Kaminari.paginate_array([])
else else
...@@ -89,6 +91,8 @@ module Gitlab ...@@ -89,6 +91,8 @@ module Gitlab
end end
def commits(page: 1, per_page: 20) def commits(page: 1, per_page: 20)
return Kaminari.paginate_array([]) unless Ability.allowed?(@current_user, :download_code, project)
if project.empty_repo? || query.blank? if project.empty_repo? || query.blank?
Kaminari.paginate_array([]) Kaminari.paginate_array([])
else else
......
...@@ -34,8 +34,8 @@ describe Gitlab::Elastic::ProjectSearchResults, lib: true do ...@@ -34,8 +34,8 @@ describe Gitlab::Elastic::ProjectSearchResults, lib: true do
describe "search" do describe "search" do
it "returns correct amounts" do it "returns correct amounts" do
project = create :project project = create :project, :public
project1 = create :project project1 = create :project, :public
project.repository.index_blobs project.repository.index_blobs
project.repository.index_commits project.repository.index_commits
...@@ -64,30 +64,67 @@ describe Gitlab::Elastic::ProjectSearchResults, lib: true do ...@@ -64,30 +64,67 @@ describe Gitlab::Elastic::ProjectSearchResults, lib: true do
end end
describe "search for commits in non-default branch" do describe "search for commits in non-default branch" do
it 'finds needed commit' do let(:project) { create(:project, :public, visibility) }
project = create :project let(:visibility) { :repository_enabled }
let(:result) { described_class.new(user, 'initial', project.id, 'test') }
subject(:commits) { result.objects('commits') }
result = Gitlab::Elastic::ProjectSearchResults.new(user, 'initial', project.id, 'test') it 'finds needed commit' do
expect(result.commits_count).to eq(1) expect(result.commits_count).to eq(1)
end end
it 'responds to total_pages method' do it 'responds to total_pages method' do
project = create :project expect(commits.total_pages).to eq(1)
end
context 'disabled repository' do
let(:visibility) { :repository_disabled }
it 'hides commits from members' do
project.add_reporter(user)
is_expected.to be_empty
end
it 'hides commits from non-members' do
is_expected.to be_empty
end
end
context 'private repository' do
let(:visibility) { :repository_private }
it 'shows commits to members' do
project.add_reporter(user)
is_expected.not_to be_empty
end
result = Gitlab::Elastic::ProjectSearchResults.new(user, 'initial', project.id, 'test') it 'hides commits from non-members' do
expect(result.objects('commits').total_pages).to eq(1) is_expected.to be_empty
end
end end
end end
describe 'search for blobs in non-default branch' do describe 'search for blobs in non-default branch' do
it 'users FileFinder instead of ES search' do let(:project) { create(:project, :public, :repository_private) }
project = create :project let(:result) { Gitlab::Elastic::ProjectSearchResults.new(user, 'initial', project.id, 'test') }
subject(:blobs) { result.objects('blobs') }
it 'uses FileFinder instead of ES search' do
project.add_reporter(user)
expect_any_instance_of(Gitlab::FileFinder).to receive(:find).with('initial').and_return([]) expect_any_instance_of(Gitlab::FileFinder).to receive(:find).with('initial').and_return([])
result = Gitlab::Elastic::ProjectSearchResults.new(user, 'initial', project.id, 'test') _ = blobs
end
it 'respects project visibility' do
expect_any_instance_of(Gitlab::FileFinder).to receive(:find).never
result.blobs_count is_expected.to be_empty
end end
end end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment