summaryrefslogtreecommitdiff
path: root/spec/helpers
diff options
context:
space:
mode:
authorGitLab Release Tools Bot <robert+release-tools@gitlab.com>2019-08-29 21:34:02 +0000
committerGitLab Release Tools Bot <robert+release-tools@gitlab.com>2019-08-29 21:34:02 +0000
commit53661b1035c04b3bfe03751d4f82b060734a4fd6 (patch)
treef6f1f3ba71f49f7366b655fbdd21ab4db39e5161 /spec/helpers
parentfac22c13a8eac189fd531f6ae7016f6adaf64bcf (diff)
parentfb93142488cfb79bac45f184b7945018550bf326 (diff)
downloadgitlab-ce-53661b1035c04b3bfe03751d4f82b060734a4fd6.tar.gz
Merge branch 'security-hide_merge_request_ids_on_emails' into 'master'
Prevent disclosure of merge request id via email See merge request gitlab/gitlabhq!3313
Diffstat (limited to 'spec/helpers')
-rw-r--r--spec/helpers/emails_helper_spec.rb56
1 files changed, 44 insertions, 12 deletions
diff --git a/spec/helpers/emails_helper_spec.rb b/spec/helpers/emails_helper_spec.rb
index d25f0c6de4a..a14ae2cde4b 100644
--- a/spec/helpers/emails_helper_spec.rb
+++ b/spec/helpers/emails_helper_spec.rb
@@ -6,30 +6,62 @@ describe EmailsHelper do
let(:merge_request) { create(:merge_request) }
let(:merge_request_presenter) { merge_request.present }
- context "and format is text" do
- it "returns plain text" do
- expect(closure_reason_text(merge_request, format: :text)).to eq("via merge request #{merge_request.to_reference} (#{merge_request_presenter.web_url})")
+ context 'when user can read merge request' do
+ let(:user) { create(:user) }
+
+ before do
+ merge_request.project.add_developer(user)
+ self.instance_variable_set(:@recipient, user)
+ self.instance_variable_set(:@project, merge_request.project)
+ end
+
+ context "and format is text" do
+ it "returns plain text" do
+ expect(helper.closure_reason_text(merge_request, format: :text)).to eq("via merge request #{merge_request.to_reference} (#{merge_request_presenter.web_url})")
+ end
end
- end
- context "and format is HTML" do
- it "returns HTML" do
- expect(closure_reason_text(merge_request, format: :html)).to eq("via merge request #{link_to(merge_request.to_reference, merge_request_presenter.web_url)}")
+ context "and format is HTML" do
+ it "returns HTML" do
+ expect(helper.closure_reason_text(merge_request, format: :html)).to eq("via merge request #{link_to(merge_request.to_reference, merge_request_presenter.web_url)}")
+ end
+ end
+
+ context "and format is unknown" do
+ it "returns plain text" do
+ expect(helper.closure_reason_text(merge_request, format: :text)).to eq("via merge request #{merge_request.to_reference} (#{merge_request_presenter.web_url})")
+ end
end
end
- context "and format is unknown" do
- it "returns plain text" do
- expect(closure_reason_text(merge_request, format: :text)).to eq("via merge request #{merge_request.to_reference} (#{merge_request_presenter.web_url})")
+ context 'when user cannot read merge request' do
+ it "does not have link to merge request" do
+ expect(helper.closure_reason_text(merge_request)).to be_empty
end
end
end
context 'when given a String' do
+ let(:user) { create(:user) }
+ let(:project) { create(:project) }
let(:closed_via) { "5a0eb6fd7e0f133044378c662fcbbc0d0c16dbfa" }
- it "returns plain text" do
- expect(closure_reason_text(closed_via)).to eq("via #{closed_via}")
+ context 'when user can read commits' do
+ before do
+ project.add_developer(user)
+ self.instance_variable_set(:@recipient, user)
+ self.instance_variable_set(:@project, project)
+ end
+
+ it "returns plain text" do
+ expect(closure_reason_text(closed_via)).to eq("via #{closed_via}")
+ end
+ end
+
+ context 'when user cannot read commits' do
+ it "returns plain text" do
+ expect(closure_reason_text(closed_via)).to be_empty
+ end
end
end