diff options
author | Alex Hanselka <alex@gitlab.com> | 2019-03-20 15:47:56 -0500 |
---|---|---|
committer | Alex Hanselka <alex@gitlab.com> | 2019-03-20 15:47:56 -0500 |
commit | 442de051eeffa1bb22b9ed1f8bfe4a5423137a99 (patch) | |
tree | 00a42e3a88326b9db6099668ad29c8f946e462d1 | |
parent | 7b042e0b75d1d509359ac5c91bb9c696f614d1bf (diff) | |
parent | 3f8131133bf6310a7fc05d7a332b4560edb456ef (diff) | |
download | gitlab-ce-442de051eeffa1bb22b9ed1f8bfe4a5423137a99.tar.gz |
Merge remote-tracking branch 'dev/11-8-stable' into 11-8-stable
* dev/11-8-stable:
Update VERSION to 11.8.3
Update CHANGELOG.md for 11.8.3
Only return `commands_changes` used in frontend
-rw-r--r-- | CHANGELOG.md | 7 | ||||
-rw-r--r-- | VERSION | 2 | ||||
-rw-r--r-- | app/controllers/concerns/notes_actions.rb | 2 | ||||
-rw-r--r-- | spec/controllers/projects/notes_controller_spec.rb | 31 |
4 files changed, 40 insertions, 2 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index ef2ce0ab529..7e54cb1ccee 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,13 @@ documentation](doc/development/changelog.md) for instructions on adding your own entry. +## 11.8.3 (2019-03-19) + +### Security (1 change) + +- Remove project serialization in quick actions response. + + ## 11.8.2 (2019-03-13) ### Security (1 change) @@ -1 +1 @@ -11.8.2 +11.8.3 diff --git a/app/controllers/concerns/notes_actions.rb b/app/controllers/concerns/notes_actions.rb index 0319948a12f..80b9bdc8f24 100644 --- a/app/controllers/concerns/notes_actions.rb +++ b/app/controllers/concerns/notes_actions.rb @@ -54,7 +54,7 @@ module NotesActions respond_to do |format| format.json do json = { - commands_changes: @note.commands_changes + commands_changes: @note.commands_changes&.slice(:emoji_award, :time_estimate, :spend_time) } if @note.persisted? && return_discussion? diff --git a/spec/controllers/projects/notes_controller_spec.rb b/spec/controllers/projects/notes_controller_spec.rb index 81892575889..ec91a760388 100644 --- a/spec/controllers/projects/notes_controller_spec.rb +++ b/spec/controllers/projects/notes_controller_spec.rb @@ -397,6 +397,37 @@ describe Projects::NotesController do end end end + + context 'when creating a note with quick actions' do + context 'with commands that return changes' do + let(:note_text) { "/award :thumbsup:\n/estimate 1d\n/spend 3h" } + + it 'includes changes in commands_changes ' do + post :create, params: request_params.merge(note: { note: note_text }, format: :json) + + expect(response).to have_gitlab_http_status(200) + expect(json_response['commands_changes']).to include('emoji_award', 'time_estimate', 'spend_time') + expect(json_response['commands_changes']).not_to include('target_project', 'title') + end + end + + context 'with commands that do not return changes' do + let(:issue) { create(:issue, project: project) } + let(:other_project) { create(:project) } + let(:note_text) { "/move #{other_project.full_path}\n/title AAA" } + + before do + other_project.add_developer(user) + end + + it 'does not include changes in commands_changes' do + post :create, params: request_params.merge(note: { note: note_text }, target_type: 'issue', target_id: issue.id, format: :json) + + expect(response).to have_gitlab_http_status(200) + expect(json_response['commands_changes']).not_to include('target_project', 'title') + end + end + end end describe 'PUT update' do |