Commit 17bac491 authored by Robert Speicher's avatar Robert Speicher

Ensure Owners are included in the scope for authorized_projects

Prior, when providing a `min_access_level` parameter to this method, we
called `Gitlab::Access.values` instead of `all_values`, mistakenly
omitting the `OWNER` level.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/19878
parent 1d7ac164
...@@ -854,7 +854,7 @@ class User < ActiveRecord::Base ...@@ -854,7 +854,7 @@ class User < ActiveRecord::Base
groups.joins(:shared_projects).select(:project_id)] groups.joins(:shared_projects).select(:project_id)]
if min_access_level if min_access_level
scope = { access_level: Gitlab::Access.values.select { |access| access >= min_access_level } } scope = { access_level: Gitlab::Access.all_values.select { |access| access >= min_access_level } }
relations = [relations.shift] + relations.map { |relation| relation.where(members: scope) } relations = [relations.shift] + relations.map { |relation| relation.where(members: scope) }
end end
......
...@@ -887,16 +887,25 @@ describe User, models: true do ...@@ -887,16 +887,25 @@ describe User, models: true do
end end
describe '#authorized_projects' do describe '#authorized_projects' do
let!(:user) { create(:user) } context 'with a minimum access level' do
let!(:private_project) { create(:project, :private) } it 'includes projects for which the user is an owner' do
user = create(:user)
project = create(:empty_project, :private, namespace: user.namespace)
before do expect(user.authorized_projects(Gitlab::Access::REPORTER))
private_project.team << [user, Gitlab::Access::MASTER] .to contain_exactly(project)
end end
subject { user.authorized_projects } it 'includes projects for which the user is a master' do
user = create(:user)
project = create(:empty_project, :private)
project.team << [user, Gitlab::Access::MASTER]
it { is_expected.to eq([private_project]) } expect(user.authorized_projects(Gitlab::Access::REPORTER))
.to contain_exactly(project)
end
end
end end
describe '#ci_authorized_runners' do describe '#ci_authorized_runners' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment