diff options
author | Yorick Peterse <yorickpeterse@gmail.com> | 2016-09-20 19:37:47 +0000 |
---|---|---|
committer | Ruben Davila <rdavila84@gmail.com> | 2016-09-21 16:14:36 -0500 |
commit | 46f36341fcbe83da6ab74396ece52091db2d75e6 (patch) | |
tree | f77db1b29559de8ffd496abdfa0ac6505154fae7 | |
parent | 2eb4d00459af2732858c36919eb7d029a8f92033 (diff) | |
download | gitlab-ce-46f36341fcbe83da6ab74396ece52091db2d75e6.tar.gz |
Merge branch 'issue_20078' into 'master'
Test if issue authors can access private projects
See merge request !6419
-rw-r--r-- | CHANGELOG | 1 | ||||
-rw-r--r-- | spec/policies/project_policy_spec.rb | 13 |
2 files changed, 14 insertions, 0 deletions
diff --git a/CHANGELOG b/CHANGELOG index afbbbc043da..b7ff17c9b7c 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -56,6 +56,7 @@ v 8.12.0 (unreleased) - Emoji can be awarded on Snippets !4456 - Set path for all JavaScript cookies to honor GitLab's subdirectory setting !5627 (Mike Greiling) - Fix blame table layout width + - Spec testing if issue authors can read issues on private projects - Fix bug where pagination is still displayed despite all todos marked as done (ClemMakesApps) - Request only the LDAP attributes we need !6187 - Center build stage columns in pipeline overview (ClemMakesApps) diff --git a/spec/policies/project_policy_spec.rb b/spec/policies/project_policy_spec.rb index eda1cafd65e..a7a06744428 100644 --- a/spec/policies/project_policy_spec.rb +++ b/spec/policies/project_policy_spec.rb @@ -33,4 +33,17 @@ describe ProjectPolicy, models: true do it 'returns increasing permissions for each level' do expect(users_permissions).to eq(users_permissions.sort.uniq) end + + it 'does not include the read_issue permission when the issue author is not a member of the private project' do + project = create(:project, :private) + issue = create(:issue, project: project) + user = issue.author + + expect(project.team.member?(issue.author)).to eq(false) + + expect(BasePolicy.class_for(project).abilities(user, project).can_set). + not_to include(:read_issue) + + expect(Ability.allowed?(user, :read_issue, project)).to be_falsy + end end |