diff options
| author | Małgorzata Ksionek <meksionek@gmail.com> | 2019-03-25 11:08:20 +0100 |
|---|---|---|
| committer | Małgorzata Ksionek <meksionek@gmail.com> | 2019-03-25 11:16:42 +0100 |
| commit | 3a3748929b37a6b86e39026368c6883e8f5ef451 (patch) | |
| tree | ca66182492d1baadd9e1be33e1d6bb0e1138cf84 | |
| parent | 1d5705a84ced01bfc79b48a38ac16e769d9cc7b9 (diff) | |
| download | gitlab-ce-3a3748929b37a6b86e39026368c6883e8f5ef451.tar.gz | |
Add cr remarks
| -rw-r--r-- | app/controllers/projects_controller.rb | 6 | ||||
| -rw-r--r-- | changelogs/unreleased/security-mass-assignment-on-project-update.yml | 2 | ||||
| -rw-r--r-- | spec/controllers/projects_controller_spec.rb | 2 |
3 files changed, 5 insertions, 5 deletions
diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb index b419d669544..f76e6663995 100644 --- a/app/controllers/projects_controller.rb +++ b/app/controllers/projects_controller.rb @@ -328,9 +328,9 @@ class ProjectsController < Projects::ApplicationController end # rubocop: enable CodeReuse/ActiveRecord - def project_params(attributes: project_params_attributes) + def project_params(attributes: []) params.require(:project) - .permit(attributes) + .permit(project_params_attributes + attributes) end def project_params_attributes @@ -375,7 +375,7 @@ class ProjectsController < Projects::ApplicationController end def project_params_create_attributes - project_params_attributes << :namespace_id + [:namespace_id] end def custom_import_params diff --git a/changelogs/unreleased/security-mass-assignment-on-project-update.yml b/changelogs/unreleased/security-mass-assignment-on-project-update.yml index 8657dcdd135..93561cd91b3 100644 --- a/changelogs/unreleased/security-mass-assignment-on-project-update.yml +++ b/changelogs/unreleased/security-mass-assignment-on-project-update.yml @@ -1,5 +1,5 @@ --- -title: Disallow updating namespace during updating project +title: Disallow updating namespace when updating a project merge_request: author: type: security diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb index 41380e79305..717675d1d30 100644 --- a/spec/controllers/projects_controller_spec.rb +++ b/spec/controllers/projects_controller_spec.rb @@ -383,7 +383,7 @@ describe ProjectsController do id: project.id, project: params } - end.not_to change {project.namespace} + end.not_to change {project.reload.namespace} end def update_project(**parameters) |