diff options
author | Alex Hanselka <alex@gitlab.com> | 2019-03-20 18:10:11 -0500 |
---|---|---|
committer | Alex Hanselka <alex@gitlab.com> | 2019-03-20 18:10:11 -0500 |
commit | ef56cad784ebc2e2a9e368a0199babf9f7287248 (patch) | |
tree | f86f0eb946bbc36a216449e8e00cd4235ac0b8bc | |
parent | cd1c7e0525cd2e1bcbe69a8da2043e029e906c7b (diff) | |
parent | 2c90d094d2704b58f2dec434e6cd08427ebaf20a (diff) | |
download | gitlab-ce-ef56cad784ebc2e2a9e368a0199babf9f7287248.tar.gz |
Merge remote-tracking branch 'dev/11-9-stable' into 11-9-stable
* dev/11-9-stable:
Update VERSION to 11.9.0-rc9
Only return `commands_changes` used in frontend
-rw-r--r-- | VERSION | 2 | ||||
-rw-r--r-- | app/controllers/concerns/notes_actions.rb | 2 | ||||
-rw-r--r-- | changelogs/unreleased/security-2826-fix-project-serialization-in-quick-actions.yml | 5 | ||||
-rw-r--r-- | spec/controllers/projects/notes_controller_spec.rb | 31 |
4 files changed, 38 insertions, 2 deletions
@@ -1 +1 @@ -11.9.0-rc8 +11.9.0-rc9 diff --git a/app/controllers/concerns/notes_actions.rb b/app/controllers/concerns/notes_actions.rb index b4fee93713b..f96d1821095 100644 --- a/app/controllers/concerns/notes_actions.rb +++ b/app/controllers/concerns/notes_actions.rb @@ -48,7 +48,7 @@ module NotesActions respond_to do |format| format.json do json = { - commands_changes: @note.commands_changes + commands_changes: @note.commands_changes&.slice(:emoji_award, :time_estimate, :spend_time) } if @note.persisted? && return_discussion? diff --git a/changelogs/unreleased/security-2826-fix-project-serialization-in-quick-actions.yml b/changelogs/unreleased/security-2826-fix-project-serialization-in-quick-actions.yml new file mode 100644 index 00000000000..272f8a95957 --- /dev/null +++ b/changelogs/unreleased/security-2826-fix-project-serialization-in-quick-actions.yml @@ -0,0 +1,5 @@ +--- +title: Remove project serialization in quick actions response +merge_request: +author: +type: security diff --git a/spec/controllers/projects/notes_controller_spec.rb b/spec/controllers/projects/notes_controller_spec.rb index 0b0f5117784..deecb7fefe9 100644 --- a/spec/controllers/projects/notes_controller_spec.rb +++ b/spec/controllers/projects/notes_controller_spec.rb @@ -413,6 +413,37 @@ describe Projects::NotesController do end end end + + context 'when creating a note with quick actions' do + context 'with commands that return changes' do + let(:note_text) { "/award :thumbsup:\n/estimate 1d\n/spend 3h" } + + it 'includes changes in commands_changes ' do + post :create, params: request_params.merge(note: { note: note_text }, format: :json) + + expect(response).to have_gitlab_http_status(200) + expect(json_response['commands_changes']).to include('emoji_award', 'time_estimate', 'spend_time') + expect(json_response['commands_changes']).not_to include('target_project', 'title') + end + end + + context 'with commands that do not return changes' do + let(:issue) { create(:issue, project: project) } + let(:other_project) { create(:project) } + let(:note_text) { "/move #{other_project.full_path}\n/title AAA" } + + before do + other_project.add_developer(user) + end + + it 'does not include changes in commands_changes' do + post :create, params: request_params.merge(note: { note: note_text }, target_type: 'issue', target_id: issue.id, format: :json) + + expect(response).to have_gitlab_http_status(200) + expect(json_response['commands_changes']).not_to include('target_project', 'title') + end + end + end end describe 'PUT update' do |