Merge branch 'security-fp-stop-jobs-when-blocking-user-12-3' into '12-3-stable'

Cancel all running CI jobs when user is blocked

See merge request gitlab/gitlabhq!3436

1 files changed, 10 insertions, 0 deletions

diff --git a/app/models/user.rb b/app/models/user.rb
index 66defb4c707..a69db121a0b 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -267,6 +267,16 @@ class User < ApplicationRecord
         BLOCKED_MESSAGE
       end
     end
+
+    # rubocop: disable CodeReuse/ServiceClass
+    # Ideally we should not call a service object here but user.block
+    # is also bcalled by Users::MigrateToGhostUserService which references
+    # this state transition object in order to do a rollback.
+    # For this reason the tradeoff is to disable this cop.
+    after_transition any => :blocked do |user|
+      Ci::CancelUserPipelinesService.new.execute(user)
+    end
+    # rubocop: enable CodeReuse/ServiceClass
   end
 
   # Scopes