diff options
author | Douwe Maan <douwe@gitlab.com> | 2016-04-05 17:02:24 +0000 |
---|---|---|
committer | Rémy Coutable <remy@rymai.me> | 2016-04-07 15:48:50 +0200 |
commit | 2ac04162f31d24b6b8ba97d8912e82e5c9c06b65 (patch) | |
tree | a4beb0b7333cc9c998a8d1f1ef0704b783cfbca5 | |
parent | d55df634550e03b2aed5bbd4d7fc9d97000b75da (diff) | |
download | gitlab-ce-2ac04162f31d24b6b8ba97d8912e82e5c9c06b65.tar.gz |
Merge branch 'fix/permissions-when-importing-members' into 'master'
Check permissions when importing project members
Closes #14899
See merge request !3535
Signed-off-by: Rémy Coutable <remy@rymai.me>
-rw-r--r-- | CHANGELOG | 1 | ||||
-rw-r--r-- | app/controllers/projects/project_members_controller.rb | 11 | ||||
-rw-r--r-- | spec/controllers/projects/project_members_controller_spec.rb | 49 |
3 files changed, 58 insertions, 3 deletions
diff --git a/CHANGELOG b/CHANGELOG index 7b90122e1f1..1417cba304d 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -18,6 +18,7 @@ v 8.7.0 (unreleased) v 8.6.5 - Fix importing from GitHub Enterprise. !3529 + - Check permissions when user attempts to import members from another project. !3535 v 8.6.4 - Don't attempt to fetch any tags from a forked repo (Stan Hu) diff --git a/app/controllers/projects/project_members_controller.rb b/app/controllers/projects/project_members_controller.rb index e7bddc4a6f1..e457db2f0b7 100644 --- a/app/controllers/projects/project_members_controller.rb +++ b/app/controllers/projects/project_members_controller.rb @@ -94,9 +94,14 @@ class Projects::ProjectMembersController < Projects::ApplicationController end def apply_import - giver = Project.find(params[:source_project_id]) - status = @project.team.import(giver, current_user) - notice = status ? "Successfully imported" : "Import failed" + source_project = Project.find(params[:source_project_id]) + + if can?(current_user, :read_project_member, source_project) + status = @project.team.import(source_project, current_user) + notice = status ? "Successfully imported" : "Import failed" + else + return render_404 + end redirect_to(namespace_project_project_members_path(project.namespace, project), notice: notice) diff --git a/spec/controllers/projects/project_members_controller_spec.rb b/spec/controllers/projects/project_members_controller_spec.rb new file mode 100644 index 00000000000..d47e4ab9a4f --- /dev/null +++ b/spec/controllers/projects/project_members_controller_spec.rb @@ -0,0 +1,49 @@ +require('spec_helper') + +describe Projects::ProjectMembersController do + let(:project) { create(:project) } + let(:another_project) { create(:project, :private) } + let(:user) { create(:user) } + let(:member) { create(:user) } + + before do + project.team << [user, :master] + another_project.team << [member, :guest] + sign_in(user) + end + + describe '#apply_import' do + shared_context 'import applied' do + before do + post(:apply_import, namespace_id: project.namespace.to_param, + project_id: project.to_param, + source_project_id: another_project.id) + end + end + + context 'when user can access source project members' do + before { another_project.team << [user, :guest] } + include_context 'import applied' + + it 'imports source project members' do + expect(project.team_members).to include member + expect(response).to set_flash.to 'Successfully imported' + expect(response).to redirect_to( + namespace_project_project_members_path(project.namespace, project) + ) + end + end + + context 'when user is not member of a source project' do + include_context 'import applied' + + it 'does not import team members' do + expect(project.team_members).to_not include member + end + + it 'responds with not found' do + expect(response.status).to eq 404 + end + end + end +end |