diff options
author | Yorick Peterse <yorickpeterse@gmail.com> | 2019-03-26 16:08:28 +0000 |
---|---|---|
committer | Yorick Peterse <yorickpeterse@gmail.com> | 2019-03-26 16:08:28 +0000 |
commit | 9426a45fb6b77f9b70e16d97d41534dfb4386f86 (patch) | |
tree | da474b02158b4000f9c32cf25d202196728e7929 | |
parent | 8ab12f761f0ce6f2d114e62f70056f18f7fa5c60 (diff) | |
parent | e70564ffbaa9a12b4845395a932ed9b94d7b89fa (diff) | |
download | gitlab-ce-9426a45fb6b77f9b70e16d97d41534dfb4386f86.tar.gz |
Merge branch 'security-mass-assignment-on-project-update-11-7' into '11-7-stable'
Disallow changing namespace of a project in update method
See merge request gitlab/gitlabhq!3031
-rw-r--r-- | app/controllers/projects_controller.rb | 13 | ||||
-rw-r--r-- | changelogs/unreleased/security-mass-assignment-on-project-update.yml | 5 | ||||
-rw-r--r-- | spec/controllers/projects_controller_spec.rb | 17 |
3 files changed, 30 insertions, 5 deletions
diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb index 878816475b2..1183dd136d0 100644 --- a/app/controllers/projects_controller.rb +++ b/app/controllers/projects_controller.rb @@ -46,7 +46,7 @@ class ProjectsController < Projects::ApplicationController end def create - @project = ::Projects::CreateService.new(current_user, project_params).execute + @project = ::Projects::CreateService.new(current_user, project_params(attributes: project_params_create_attributes)).execute if @project.saved? cookies[:issue_board_welcome_hidden] = { path: project_path(@project), value: nil, expires: Time.at(0) } @@ -327,9 +327,9 @@ class ProjectsController < Projects::ApplicationController end # rubocop: enable CodeReuse/ActiveRecord - def project_params + def project_params(attributes: []) params.require(:project) - .permit(project_params_attributes) + .permit(project_params_attributes + attributes) end def project_params_attributes @@ -348,11 +348,10 @@ class ProjectsController < Projects::ApplicationController :last_activity_at, :lfs_enabled, :name, - :namespace_id, :only_allow_merge_if_all_discussions_are_resolved, :only_allow_merge_if_pipeline_succeeds, - :printing_merge_request_link_enabled, :path, + :printing_merge_request_link_enabled, :public_builds, :request_access_enabled, :runners_token, @@ -374,6 +373,10 @@ class ProjectsController < Projects::ApplicationController ] end + def project_params_create_attributes + [:namespace_id] + end + def custom_import_params {} end diff --git a/changelogs/unreleased/security-mass-assignment-on-project-update.yml b/changelogs/unreleased/security-mass-assignment-on-project-update.yml new file mode 100644 index 00000000000..93561cd91b3 --- /dev/null +++ b/changelogs/unreleased/security-mass-assignment-on-project-update.yml @@ -0,0 +1,5 @@ +--- +title: Disallow updating namespace when updating a project +merge_request: +author: +type: security diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb index f84f069f4db..16d4a19fe66 100644 --- a/spec/controllers/projects_controller_spec.rb +++ b/spec/controllers/projects_controller_spec.rb @@ -369,6 +369,23 @@ describe ProjectsController do end end + it 'does not update namespace' do + controller.instance_variable_set(:@project, project) + + params = { + namespace_id: 'test' + } + + expect do + put :update, + params: { + namespace_id: project.namespace, + id: project.id, + project: params + } + end.not_to change { project.namespace.reload } + end + def update_project(**parameters) put :update, params: { |