summaryrefslogtreecommitdiff
path: root/spec/serializers
diff options
context:
space:
mode:
authorGitLab Release Tools Bot <robert+release-tools@gitlab.com>2019-07-26 13:40:52 +0000
committerGitLab Release Tools Bot <robert+release-tools@gitlab.com>2019-07-26 13:40:52 +0000
commit4b2d49b7285f7968e894c635321f878d77773bb8 (patch)
tree48868da3656e4fcd86253bb5536f15dcc8757a5e /spec/serializers
parentcfc327b0c0cd59bd1283eda752f452dd9cbd1729 (diff)
parent43830eca33b6be5d59685be5c2f3270ed81bf751 (diff)
downloadgitlab-ce-4b2d49b7285f7968e894c635321f878d77773bb8.tar.gz
Merge branch 'security-hide_moved_issue_id' into 'master'
Do not show moved issue ids for user not authorized Closes #2878 See merge request gitlab/gitlabhq!3230
Diffstat (limited to 'spec/serializers')
-rw-r--r--spec/serializers/issue_entity_spec.rb33
1 files changed, 33 insertions, 0 deletions
diff --git a/spec/serializers/issue_entity_spec.rb b/spec/serializers/issue_entity_spec.rb
index caa3e41402b..0e05b3c84f4 100644
--- a/spec/serializers/issue_entity_spec.rb
+++ b/spec/serializers/issue_entity_spec.rb
@@ -17,4 +17,37 @@ describe IssueEntity do
it 'has time estimation attributes' do
expect(subject).to include(:time_estimate, :total_time_spent, :human_time_estimate, :human_total_time_spent)
end
+
+ context 'when issue got moved' do
+ let(:public_project) { create(:project, :public) }
+ let(:member) { create(:user) }
+ let(:non_member) { create(:user) }
+ let(:issue) { create(:issue, project: public_project) }
+
+ before do
+ project.add_developer(member)
+ public_project.add_developer(member)
+ Issues::MoveService.new(public_project, member).execute(issue, project)
+ end
+
+ context 'when user cannot read target project' do
+ it 'does not return moved_to_id' do
+ request = double('request', current_user: non_member)
+
+ response = described_class.new(issue, request: request).as_json
+
+ expect(response[:moved_to_id]).to be_nil
+ end
+ end
+
+ context 'when user can read target project' do
+ it 'returns moved moved_to_id' do
+ request = double('request', current_user: member)
+
+ response = described_class.new(issue, request: request).as_json
+
+ expect(response[:moved_to_id]).to eq(issue.moved_to_id)
+ end
+ end
+ end
end