diff options
author | Douglas Barbosa Alexandre <dbalexandre@gmail.com> | 2016-06-06 16:13:31 -0300 |
---|---|---|
committer | Douglas Barbosa Alexandre <dbalexandre@gmail.com> | 2016-06-13 19:32:00 -0300 |
commit | b56c45675019baaaf47615d51c08d5caa0734ad3 (patch) | |
tree | b933c21ab49a745a6839aa1127c237ffe7a3a3fb /spec/lib/gitlab/search_results_spec.rb | |
parent | af8500f43010f42176b2ec1814f0fe7248258b05 (diff) | |
download | gitlab-ce-b56c45675019baaaf47615d51c08d5caa0734ad3.tar.gz |
Project members with guest role can't access confidential issues
Diffstat (limited to 'spec/lib/gitlab/search_results_spec.rb')
-rw-r--r-- | spec/lib/gitlab/search_results_spec.rb | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/spec/lib/gitlab/search_results_spec.rb b/spec/lib/gitlab/search_results_spec.rb index f4afe597e8d..1bb444bf34f 100644 --- a/spec/lib/gitlab/search_results_spec.rb +++ b/spec/lib/gitlab/search_results_spec.rb @@ -86,6 +86,22 @@ describe Gitlab::SearchResults do expect(results.issues_count).to eq 1 end + it 'should not list confidential issues for project members with guest role' do + project_1.team << [member, :guest] + project_2.team << [member, :guest] + + results = described_class.new(member, limit_projects, query) + issues = results.objects('issues') + + expect(issues).to include issue + expect(issues).not_to include security_issue_1 + expect(issues).not_to include security_issue_2 + expect(issues).not_to include security_issue_3 + expect(issues).not_to include security_issue_4 + expect(issues).not_to include security_issue_5 + expect(results.issues_count).to eq 1 + end + it 'should list confidential issues for author' do results = described_class.new(author, limit_projects, query) issues = results.objects('issues') |