diff options
| -rw-r--r-- | app/controllers/sent_notifications_controller.rb | 6 | ||||
| -rw-r--r-- | changelogs/unreleased/security-64938-dont-disclose-path.yml | 6 | ||||
| -rw-r--r-- | spec/controllers/sent_notifications_controller_spec.rb | 29 |
3 files changed, 40 insertions, 1 deletions
diff --git a/app/controllers/sent_notifications_controller.rb b/app/controllers/sent_notifications_controller.rb index 51a67cd2e3b..893f5145e99 100644 --- a/app/controllers/sent_notifications_controller.rb +++ b/app/controllers/sent_notifications_controller.rb @@ -19,7 +19,11 @@ class SentNotificationsController < ApplicationController flash[:notice] = _("You have been unsubscribed from this thread.") if current_user - redirect_to noteable_path(noteable) + if current_user.can?(:"read_#{noteable.class.to_ability_name}", noteable) + redirect_to noteable_path(noteable) + else + redirect_to root_path + end else redirect_to new_user_session_path end diff --git a/changelogs/unreleased/security-64938-dont-disclose-path.yml b/changelogs/unreleased/security-64938-dont-disclose-path.yml new file mode 100644 index 00000000000..0c858401233 --- /dev/null +++ b/changelogs/unreleased/security-64938-dont-disclose-path.yml @@ -0,0 +1,6 @@ +--- +title: Fix new project path being disclosed through unsubscribe link of issue/merge + requests +merge_request: +author: +type: security diff --git a/spec/controllers/sent_notifications_controller_spec.rb b/spec/controllers/sent_notifications_controller_spec.rb index fafcd6927cd..0e634d8ba99 100644 --- a/spec/controllers/sent_notifications_controller_spec.rb +++ b/spec/controllers/sent_notifications_controller_spec.rb @@ -208,6 +208,35 @@ describe SentNotificationsController do .to redirect_to(project_merge_request_path(project, merge_request)) end end + + context 'when project is private' do + context 'and user does not have access' do + let(:noteable) { issue } + let(:target_project) { private_project } + + before do + get(:unsubscribe, params: { id: sent_notification.reply_key }) + end + + it 'unsubscribes user and redirects to root path' do + expect(response).to redirect_to(root_path) + end + end + + context 'and user has access' do + let(:noteable) { issue } + let(:target_project) { private_project } + + before do + private_project.add_developer(user) + get(:unsubscribe, params: { id: sent_notification.reply_key }) + end + + it 'unsubscribes user and redirects to issue path' do + expect(response).to redirect_to(project_issue_path(private_project, issue)) + end + end + end end end end |