diff options
author | John Jarvis <jarv@gitlab.com> | 2018-12-27 08:42:48 +0000 |
---|---|---|
committer | John Jarvis <jarv@gitlab.com> | 2018-12-27 08:42:48 +0000 |
commit | 2975f931f1e9d07436b71e80f61d0d0881b2ece6 (patch) | |
tree | 7e386520c979fc13697d36269f177824ffa32e0c | |
parent | 0287db5c72d7dd9c902b87dfa85a2c7b87bafe69 (diff) | |
parent | 7b0c6facc9523eb2c162cdb7d9e157fcc477ffab (diff) | |
download | gitlab-ce-2975f931f1e9d07436b71e80f61d0d0881b2ece6.tar.gz |
Merge branch 'security-11-5-guests-jobs-api' into 'security-11-5'
[11.5] Guest users have access to all Job information via the API
See merge request gitlab/gitlabhq!2745
-rw-r--r-- | changelogs/unreleased/security-11-5-guests-jobs-api.yml | 5 | ||||
-rw-r--r-- | lib/api/jobs.rb | 5 | ||||
-rw-r--r-- | spec/requests/api/jobs_spec.rb | 32 |
3 files changed, 36 insertions, 6 deletions
diff --git a/changelogs/unreleased/security-11-5-guests-jobs-api.yml b/changelogs/unreleased/security-11-5-guests-jobs-api.yml new file mode 100644 index 00000000000..83022e91aca --- /dev/null +++ b/changelogs/unreleased/security-11-5-guests-jobs-api.yml @@ -0,0 +1,5 @@ +--- +title: Authorize before reading job information via API. +merge_request: +author: +type: security diff --git a/lib/api/jobs.rb b/lib/api/jobs.rb index 697555c9605..4cd46516f17 100644 --- a/lib/api/jobs.rb +++ b/lib/api/jobs.rb @@ -38,6 +38,8 @@ module API end # rubocop: disable CodeReuse/ActiveRecord get ':id/jobs' do + authorize_read_builds! + builds = user_project.builds.order('id DESC') builds = filter_builds(builds, params[:scope]) @@ -56,7 +58,10 @@ module API end # rubocop: disable CodeReuse/ActiveRecord get ':id/pipelines/:pipeline_id/jobs' do + authorize!(:read_pipeline, user_project) pipeline = user_project.pipelines.find(params[:pipeline_id]) + authorize!(:read_build, pipeline) + builds = pipeline.builds builds = filter_builds(builds, params[:scope]) builds = builds.preload(:job_artifacts_archive, :job_artifacts, project: [:namespace]) diff --git a/spec/requests/api/jobs_spec.rb b/spec/requests/api/jobs_spec.rb index 8770365c893..402031075e7 100644 --- a/spec/requests/api/jobs_spec.rb +++ b/spec/requests/api/jobs_spec.rb @@ -142,10 +142,20 @@ describe API::Jobs do end context 'unauthorized user' do - let(:api_user) { nil } + context 'when user is not logged in' do + let(:api_user) { nil } - it 'does not return project jobs' do - expect(response).to have_gitlab_http_status(401) + it 'does not return project jobs' do + expect(response).to have_gitlab_http_status(401) + end + end + + context 'when user is guest' do + let(:api_user) { guest } + + it 'does not return project jobs' do + expect(response).to have_gitlab_http_status(403) + end end end @@ -241,10 +251,20 @@ describe API::Jobs do end context 'unauthorized user' do - let(:api_user) { nil } + context 'when user is not logged in' do + let(:api_user) { nil } - it 'does not return jobs' do - expect(response).to have_gitlab_http_status(401) + it 'does not return jobs' do + expect(response).to have_gitlab_http_status(401) + end + end + + context 'when user is guest' do + let(:api_user) { guest } + + it 'does not return jobs' do + expect(response).to have_gitlab_http_status(403) + end end end end |