summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDouwe Maan <douwe@gitlab.com>2016-04-05 17:02:24 +0000
committerRémy Coutable <remy@rymai.me>2016-04-07 15:48:50 +0200
commit2ac04162f31d24b6b8ba97d8912e82e5c9c06b65 (patch)
treea4beb0b7333cc9c998a8d1f1ef0704b783cfbca5
parentd55df634550e03b2aed5bbd4d7fc9d97000b75da (diff)
downloadgitlab-ce-2ac04162f31d24b6b8ba97d8912e82e5c9c06b65.tar.gz
Merge branch 'fix/permissions-when-importing-members' into 'master'
Check permissions when importing project members Closes #14899 See merge request !3535 Signed-off-by: Rémy Coutable <remy@rymai.me>
-rw-r--r--CHANGELOG1
-rw-r--r--app/controllers/projects/project_members_controller.rb11
-rw-r--r--spec/controllers/projects/project_members_controller_spec.rb49
3 files changed, 58 insertions, 3 deletions
diff --git a/CHANGELOG b/CHANGELOG
index 7b90122e1f1..1417cba304d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -18,6 +18,7 @@ v 8.7.0 (unreleased)
v 8.6.5
- Fix importing from GitHub Enterprise. !3529
+ - Check permissions when user attempts to import members from another project. !3535
v 8.6.4
- Don't attempt to fetch any tags from a forked repo (Stan Hu)
diff --git a/app/controllers/projects/project_members_controller.rb b/app/controllers/projects/project_members_controller.rb
index e7bddc4a6f1..e457db2f0b7 100644
--- a/app/controllers/projects/project_members_controller.rb
+++ b/app/controllers/projects/project_members_controller.rb
@@ -94,9 +94,14 @@ class Projects::ProjectMembersController < Projects::ApplicationController
end
def apply_import
- giver = Project.find(params[:source_project_id])
- status = @project.team.import(giver, current_user)
- notice = status ? "Successfully imported" : "Import failed"
+ source_project = Project.find(params[:source_project_id])
+
+ if can?(current_user, :read_project_member, source_project)
+ status = @project.team.import(source_project, current_user)
+ notice = status ? "Successfully imported" : "Import failed"
+ else
+ return render_404
+ end
redirect_to(namespace_project_project_members_path(project.namespace, project),
notice: notice)
diff --git a/spec/controllers/projects/project_members_controller_spec.rb b/spec/controllers/projects/project_members_controller_spec.rb
new file mode 100644
index 00000000000..d47e4ab9a4f
--- /dev/null
+++ b/spec/controllers/projects/project_members_controller_spec.rb
@@ -0,0 +1,49 @@
+require('spec_helper')
+
+describe Projects::ProjectMembersController do
+ let(:project) { create(:project) }
+ let(:another_project) { create(:project, :private) }
+ let(:user) { create(:user) }
+ let(:member) { create(:user) }
+
+ before do
+ project.team << [user, :master]
+ another_project.team << [member, :guest]
+ sign_in(user)
+ end
+
+ describe '#apply_import' do
+ shared_context 'import applied' do
+ before do
+ post(:apply_import, namespace_id: project.namespace.to_param,
+ project_id: project.to_param,
+ source_project_id: another_project.id)
+ end
+ end
+
+ context 'when user can access source project members' do
+ before { another_project.team << [user, :guest] }
+ include_context 'import applied'
+
+ it 'imports source project members' do
+ expect(project.team_members).to include member
+ expect(response).to set_flash.to 'Successfully imported'
+ expect(response).to redirect_to(
+ namespace_project_project_members_path(project.namespace, project)
+ )
+ end
+ end
+
+ context 'when user is not member of a source project' do
+ include_context 'import applied'
+
+ it 'does not import team members' do
+ expect(project.team_members).to_not include member
+ end
+
+ it 'responds with not found' do
+ expect(response.status).to eq 404
+ end
+ end
+ end
+end