diff options
| -rw-r--r-- | app/models/project.rb | 5 | ||||
| -rw-r--r-- | changelogs/unreleased/mc-bug-38984-wildcard-protected-tags.yml | 5 | ||||
| -rw-r--r-- | spec/models/ci/build_spec.rb | 8 | ||||
| -rw-r--r-- | spec/models/group_spec.rb | 8 | ||||
| -rw-r--r-- | spec/models/project_spec.rb | 8 |
5 files changed, 25 insertions, 9 deletions
diff --git a/app/models/project.rb b/app/models/project.rb index 02f37135670..da09f245b48 100644 --- a/app/models/project.rb +++ b/app/models/project.rb @@ -1587,8 +1587,11 @@ class Project < ActiveRecord::Base end def protected_for?(ref) - ProtectedBranch.protected?(self, ref) || + if repository.branch_exists?(ref) + ProtectedBranch.protected?(self, ref) + elsif repository.tag_exists?(ref) ProtectedTag.protected?(self, ref) + end end def deployment_variables diff --git a/changelogs/unreleased/mc-bug-38984-wildcard-protected-tags.yml b/changelogs/unreleased/mc-bug-38984-wildcard-protected-tags.yml new file mode 100644 index 00000000000..27219b096af --- /dev/null +++ b/changelogs/unreleased/mc-bug-38984-wildcard-protected-tags.yml @@ -0,0 +1,5 @@ +--- +title: Fix wilcard protected tags protecting all branches +merge_request: +author: +type: security diff --git a/spec/models/ci/build_spec.rb b/spec/models/ci/build_spec.rb index 14b68d49913..5a5fc95832e 100644 --- a/spec/models/ci/build_spec.rb +++ b/spec/models/ci/build_spec.rb @@ -1582,7 +1582,7 @@ describe Ci::Build do context 'when the branch is protected' do before do - create(:protected_branch, project: build.project, name: build.ref) + allow(build.project).to receive(:protected_for?).with(build.ref).and_return(true) end it { is_expected.to include(protected_variable) } @@ -1590,7 +1590,7 @@ describe Ci::Build do context 'when the tag is protected' do before do - create(:protected_tag, project: build.project, name: build.ref) + allow(build.project).to receive(:protected_for?).with(build.ref).and_return(true) end it { is_expected.to include(protected_variable) } @@ -1627,7 +1627,7 @@ describe Ci::Build do context 'when the branch is protected' do before do - create(:protected_branch, project: build.project, name: build.ref) + allow(build.project).to receive(:protected_for?).with(build.ref).and_return(true) end it { is_expected.to include(protected_variable) } @@ -1635,7 +1635,7 @@ describe Ci::Build do context 'when the tag is protected' do before do - create(:protected_tag, project: build.project, name: build.ref) + allow(build.project).to receive(:protected_for?).with(build.ref).and_return(true) end it { is_expected.to include(protected_variable) } diff --git a/spec/models/group_spec.rb b/spec/models/group_spec.rb index 5e82a2988ce..1335bc04921 100644 --- a/spec/models/group_spec.rb +++ b/spec/models/group_spec.rb @@ -550,7 +550,7 @@ describe Group do context 'when the ref is a protected branch' do before do - create(:protected_branch, name: 'ref', project: project) + allow(project).to receive(:protected_for?).with('ref').and_return(true) end it_behaves_like 'ref is protected' @@ -558,7 +558,7 @@ describe Group do context 'when the ref is a protected tag' do before do - create(:protected_tag, name: 'ref', project: project) + allow(project).to receive(:protected_for?).with('ref').and_return(true) end it_behaves_like 'ref is protected' @@ -572,6 +572,10 @@ describe Group do let(:variable_child_2) { create(:ci_group_variable, group: group_child_2) } let(:variable_child_3) { create(:ci_group_variable, group: group_child_3) } + before do + allow(project).to receive(:protected_for?).with('ref').and_return(true) + end + it 'returns all variables belong to the group and parent groups' do expected_array1 = [protected_variable, secret_variable] expected_array2 = [variable_child, variable_child_2, variable_child_3] diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb index 6f24dd6811e..69d18167a57 100644 --- a/spec/models/project_spec.rb +++ b/spec/models/project_spec.rb @@ -2094,7 +2094,7 @@ describe Project do context 'when the ref is a protected branch' do before do - create(:protected_branch, name: 'ref', project: project) + allow(project).to receive(:protected_for?).with('ref').and_return(true) end it_behaves_like 'ref is protected' @@ -2102,7 +2102,7 @@ describe Project do context 'when the ref is a protected tag' do before do - create(:protected_tag, name: 'ref', project: project) + allow(project).to receive(:protected_for?).with('ref').and_return(true) end it_behaves_like 'ref is protected' @@ -2127,6 +2127,8 @@ describe Project do context 'when the ref is a protected branch' do before do + allow(project).to receive(:repository).and_call_original + allow(project).to receive_message_chain(:repository, :branch_exists?).and_return(true) create(:protected_branch, name: 'ref', project: project) end @@ -2137,6 +2139,8 @@ describe Project do context 'when the ref is a protected tag' do before do + allow(project).to receive_message_chain(:repository, :branch_exists?).and_return(false) + allow(project).to receive_message_chain(:repository, :tag_exists?).and_return(true) create(:protected_tag, name: 'ref', project: project) end |