Commit ff06452e authored by Felipe Artur's avatar Felipe Artur

Prevent leaking information when issue is moved

Prevent leaking namespace and project names on moved issue links
parent b4165554
......@@ -15,7 +15,7 @@
.issuable-status-box.status-box.status-box-issue-closed{ class: issue_button_visibility(@issue, false) }
= sprite_icon('mobile-issue-close', size: 16, css_class: 'd-block d-sm-none')
.d-none.d-sm-block
- if @issue.moved?
- if @issue.moved? && can?(current_user, :read_issue, @issue.moved_to)
- moved_link_start = "<a href=\"#{issue_path(@issue.moved_to)}\" class=\"text-white text-underline\">".html_safe
- moved_link_end = '</a>'.html_safe
= s_('IssuableStatus|Closed (%{moved_link_start}moved%{moved_link_end})').html_safe % {moved_link_start: moved_link_start,
......
---
title: 'Resolve: moving an issue to private repo leaks namespace and project name'
merge_request:
author:
type: security
......@@ -19,6 +19,7 @@ describe 'projects/issues/show' do
context 'when the issue is closed' do
before do
allow(issue).to receive(:closed?).and_return(true)
allow(view).to receive(:current_user).and_return(user)
end
context 'when the issue was moved' do
......@@ -28,6 +29,11 @@ describe 'projects/issues/show' do
issue.moved_to = new_issue
end
context 'when user can see the moved issue' do
before do
project.add_developer(user)
end
it 'shows "Closed (moved)" if an issue has been moved' do
render
......@@ -41,6 +47,15 @@ describe 'projects/issues/show' do
end
end
context 'when user cannot see moved issue' do
it 'does not show moved issue link' do
render
expect(rendered).not_to have_selector("a[href=\"#{issue_path(new_issue)}\"]", text: 'moved')
end
end
end
it 'shows "Closed" if an issue has not been moved' do
render
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment