diff options
author | Valery Sizov <valery@gitlab.com> | 2016-05-26 14:12:43 +0300 |
---|---|---|
committer | Valery Sizov <valery@gitlab.com> | 2016-05-31 21:32:53 +0300 |
commit | 9154586ce5c46dfac83a1ed1e4beac1940913f16 (patch) | |
tree | f7915c3bf9e7a55ba345bcafe0beb8df06234dc7 /spec/models/note_spec.rb | |
parent | 32b9276c25c95e2bb9fb7805b4457fdd948ea08e (diff) | |
download | gitlab-ce-9154586ce5c46dfac83a1ed1e4beac1940913f16.tar.gz |
Confidential notes data leak
Diffstat (limited to 'spec/models/note_spec.rb')
-rw-r--r-- | spec/models/note_spec.rb | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/spec/models/note_spec.rb b/spec/models/note_spec.rb index 5d916f0e6a6..64a5bab7cb1 100644 --- a/spec/models/note_spec.rb +++ b/spec/models/note_spec.rb @@ -111,6 +111,25 @@ describe Note, models: true do it 'returns notes with matching content regardless of the casing' do expect(described_class.search('WOW')).to eq([note]) end + + context "confidential issues" do + let(:user) { create :user } + let(:confidential_issue) { create(:issue, :confidential, author: user) } + let(:confidential_note) { create :note, note: "Random", noteable: confidential_issue } + + it "returns notes with matching content if user can see the issue" do + expect(described_class.search(confidential_note.note, as_user: user)).to eq([confidential_note]) + end + + it "does not return notes with matching content if user can not see the issue" do + user = create :user + expect(described_class.search(confidential_note.note, as_user: user)).to be_empty + end + + it "does not return notes with matching content for unauthenticated users" do + expect(described_class.search(confidential_note.note)).to be_empty + end + end end describe '.grouped_awards' do |