Respect permissions when showing Failed Jobs

3 files changed, 16 insertions, 7 deletions

diff --git a/app/controllers/projects/pipelines_controller.rb b/app/controllers/projects/pipelines_controller.rb
index 78d109cf33e..d9d771f2f95 100644
--- a/app/controllers/projects/pipelines_controller.rb
+++ b/app/controllers/projects/pipelines_controller.rb
@@ -87,7 +87,7 @@ class Projects::PipelinesController < Projects::ApplicationController
   end
 
   def failures
-    if @pipeline.statuses.latest.failed.present?
+    if @pipeline.failed_builds.present?
       render_show
     else
       redirect_to pipeline_path(@pipeline)
diff --git a/app/presenters/ci/pipeline_presenter.rb b/app/presenters/ci/pipeline_presenter.rb
index 099b4720fb6..cc2bce9862d 100644
--- a/app/presenters/ci/pipeline_presenter.rb
+++ b/app/presenters/ci/pipeline_presenter.rb
@@ -1,11 +1,21 @@
 module Ci
   class PipelinePresenter < Gitlab::View::Presenter::Delegated
+    include Gitlab::Utils::StrongMemoize
+
     FAILURE_REASONS = {
       config_error: 'CI/CD YAML configuration error!'
     }.freeze
 
     presents :pipeline
 
+    def failed_builds
+      return [] unless can?(current_user, :read_build, pipeline)
+
+      strong_memoize(:failed_builds) do
+        pipeline.builds.latest.failed
+      end
+    end
+
     def failure_reason
       return unless pipeline.failure_reason?
 
diff --git a/app/views/projects/pipelines/_with_tabs.html.haml b/app/views/projects/pipelines/_with_tabs.html.haml
index 218e7338c83..4dbf95be357 100644
--- a/app/views/projects/pipelines/_with_tabs.html.haml
+++ b/app/views/projects/pipelines/_with_tabs.html.haml
@@ -1,5 +1,3 @@
-- failed_builds = @pipeline.statuses.latest.failed
-
 .tabs-holder
   %ul.pipelines-tabs.nav-links.no-top.no-bottom.mobile-separator
     %li.js-pipeline-tab-link
@@ -9,11 +7,11 @@
       = link_to builds_project_pipeline_path(@project, @pipeline), data: { target: '#js-tab-builds', action: 'builds', toggle: 'tab' }, class: 'builds-tab' do
         = _("Jobs")
         %span.badge.js-builds-counter= pipeline.total_size
-    - if failed_builds.present?
+    - if @pipeline.failed_builds.present?
       %li.js-failures-tab-link
         = link_to failures_project_pipeline_path(@project, @pipeline), data: { target: '#js-tab-failures', action: 'failures', toggle: 'tab' }, class: 'failures-tab' do
           = _("Failed Jobs")
-          %span.badge.js-failures-counter= failed_builds.count
+          %span.badge.js-failures-counter= @pipeline.failed_builds.count
 
 .tab-content
   #js-tab-pipeline.tab-pane
@@ -43,9 +41,10 @@
             %th Coverage
             %th
         = render partial: "projects/stage/stage", collection: pipeline.legacy_stages, as: :stage
-  - if failed_builds.present?
+
+  - if @pipeline.failed_builds.present?
     #js-tab-failures.build-failures.tab-pane
-      - failed_builds.each_with_index do |build, index|
+      - @pipeline.failed_builds.each_with_index do |build, index|
         .build-state
           %span.ci-status-icon-failed= custom_icon('icon_status_failed')
           %span.stage