diff options
author | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-08-29 21:34:10 +0000 |
---|---|---|
committer | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-08-29 21:34:10 +0000 |
commit | e20fb7cb395e9c6594a098eddd816079259f64d9 (patch) | |
tree | d111292dbd7348f0c87146444259593ebfe64f3f /spec/controllers | |
parent | 4ed9802a40a992bfd5c8bf2c41499d54e44aff5a (diff) | |
parent | 1c7c91806d4b9866f512f50f36c9c74b48cb8229 (diff) | |
download | gitlab-ce-e20fb7cb395e9c6594a098eddd816079259f64d9.tar.gz |
Merge branch 'security-mr-head-pipeline-leak' into 'master'
Permission fix for MergeRequestsController#pipeline_status
See merge request gitlab/gitlabhq!3274
Diffstat (limited to 'spec/controllers')
-rw-r--r-- | spec/controllers/projects/merge_requests_controller_spec.rb | 30 |
1 files changed, 26 insertions, 4 deletions
diff --git a/spec/controllers/projects/merge_requests_controller_spec.rb b/spec/controllers/projects/merge_requests_controller_spec.rb index 9cc76eb8c28..4b9b6913997 100644 --- a/spec/controllers/projects/merge_requests_controller_spec.rb +++ b/spec/controllers/projects/merge_requests_controller_spec.rb @@ -1096,17 +1096,39 @@ describe Projects::MergeRequestsController do let(:status) { pipeline.detailed_status(double('user')) } - before do + it 'returns a detailed head_pipeline status in json' do get_pipeline_status - end - it 'return a detailed head_pipeline status in json' do expect(response).to have_gitlab_http_status(:ok) expect(json_response['text']).to eq status.text expect(json_response['label']).to eq status.label expect(json_response['icon']).to eq status.icon expect(json_response['favicon']).to match_asset_path "/assets/ci_favicons/#{status.favicon}.png" end + + context 'with project member visibility on a public project' do + let(:user) { create(:user) } + let(:project) { create(:project, :repository, :public, :builds_private) } + + it 'returns pipeline data to project members' do + project.add_developer(user) + + get_pipeline_status + + expect(response).to have_gitlab_http_status(:ok) + expect(json_response['text']).to eq status.text + expect(json_response['label']).to eq status.label + expect(json_response['icon']).to eq status.icon + expect(json_response['favicon']).to match_asset_path "/assets/ci_favicons/#{status.favicon}.png" + end + + it 'returns blank OK response to non-project-members' do + get_pipeline_status + + expect(response).to have_gitlab_http_status(:ok) + expect(json_response).to be_empty + end + end end context 'when head_pipeline does not exist' do @@ -1114,7 +1136,7 @@ describe Projects::MergeRequestsController do get_pipeline_status end - it 'return empty' do + it 'returns blank OK response' do expect(response).to have_gitlab_http_status(:ok) expect(json_response).to be_empty end |