diff options
author | Felipe Artur <felipefac@gmail.com> | 2018-12-11 16:15:10 -0200 |
---|---|---|
committer | Felipe Artur <felipefac@gmail.com> | 2018-12-14 10:38:52 -0200 |
commit | 1653f7b1c68b2ea7da8df84ed459b9578e3dff8f (patch) | |
tree | 9e55514e5682aa8799469286265b3e51af84b003 /app/services/members | |
parent | cc7353523bc1d19054769d7a0a61b0cb7f6ce4e3 (diff) | |
download | gitlab-ce-1653f7b1c68b2ea7da8df84ed459b9578e3dff8f.tar.gz |
Delete confidential issue todos for guests
Fix leaking information of confidential issues on TODOs
when user is downgraded to guest access.
Diffstat (limited to 'app/services/members')
-rw-r--r-- | app/services/members/base_service.rb | 6 | ||||
-rw-r--r-- | app/services/members/destroy_service.rb | 8 | ||||
-rw-r--r-- | app/services/members/update_service.rb | 9 |
3 files changed, 16 insertions, 7 deletions
diff --git a/app/services/members/base_service.rb b/app/services/members/base_service.rb index d734571f835..e78affff797 100644 --- a/app/services/members/base_service.rb +++ b/app/services/members/base_service.rb @@ -47,5 +47,11 @@ module Members raise "Unknown action '#{action}' on #{member}!" end end + + def enqueue_delete_todos(member) + type = member.is_a?(GroupMember) ? 'Group' : 'Project' + # don't enqueue immediately to prevent todos removal in case of a mistake + TodosDestroyer::EntityLeaveWorker.perform_in(Todo::WAIT_FOR_DELETE, member.user_id, member.source_id, type) + end end end diff --git a/app/services/members/destroy_service.rb b/app/services/members/destroy_service.rb index c186a5971dc..ae0c644e6c0 100644 --- a/app/services/members/destroy_service.rb +++ b/app/services/members/destroy_service.rb @@ -15,7 +15,7 @@ module Members notification_service.decline_access_request(member) end - enqeue_delete_todos(member) + enqueue_delete_todos(member) after_execute(member: member) @@ -24,12 +24,6 @@ module Members private - def enqeue_delete_todos(member) - type = member.is_a?(GroupMember) ? 'Group' : 'Project' - # don't enqueue immediately to prevent todos removal in case of a mistake - TodosDestroyer::EntityLeaveWorker.perform_in(1.hour, member.user_id, member.source_id, type) - end - def can_destroy_member?(member) can?(current_user, destroy_member_permission(member), member) end diff --git a/app/services/members/update_service.rb b/app/services/members/update_service.rb index 1f5618dae53..ff8d5c1d8c9 100644 --- a/app/services/members/update_service.rb +++ b/app/services/members/update_service.rb @@ -10,9 +10,18 @@ module Members if member.update(params) after_execute(action: permission, old_access_level: old_access_level, member: member) + + # Deletes only confidential issues todos for guests + enqueue_delete_todos(member) if downgrading_to_guest? end member end + + private + + def downgrading_to_guest? + params[:access_level] == Gitlab::Access::GUEST + end end end |