summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--app/services/projects/unlink_fork_service.rb2
-rw-r--r--changelogs/unreleased/security-id-leave-pool-for-private-forks.yml5
-rw-r--r--changelogs/unreleased/security-trigger-system-hook-by-post.yml5
-rw-r--r--doc/api/system_hooks.md4
-rw-r--r--lib/api/system_hooks.rb2
-rw-r--r--spec/factories/pool_repositories.rb2
-rw-r--r--spec/requests/api/system_hooks_spec.rb10
-rw-r--r--spec/services/projects/fork_service_spec.rb2
-rw-r--r--spec/services/projects/unlink_fork_service_spec.rb11
9 files changed, 33 insertions, 10 deletions
diff --git a/app/services/projects/unlink_fork_service.rb b/app/services/projects/unlink_fork_service.rb
index 6ba3356d612..91632e50ba8 100644
--- a/app/services/projects/unlink_fork_service.rb
+++ b/app/services/projects/unlink_fork_service.rb
@@ -32,6 +32,8 @@ module Projects
if fork_network = @project.root_of_fork_network
fork_network.update(root_project: nil, deleted_root_project_name: @project.full_name)
end
+
+ @project.leave_pool_repository
end
# rubocop: disable Cop/InBatches
diff --git a/changelogs/unreleased/security-id-leave-pool-for-private-forks.yml b/changelogs/unreleased/security-id-leave-pool-for-private-forks.yml
new file mode 100644
index 00000000000..df4688583d4
--- /dev/null
+++ b/changelogs/unreleased/security-id-leave-pool-for-private-forks.yml
@@ -0,0 +1,5 @@
+---
+title: Leave pool repository on fork unlinking
+merge_request:
+author:
+type: security
diff --git a/changelogs/unreleased/security-trigger-system-hook-by-post.yml b/changelogs/unreleased/security-trigger-system-hook-by-post.yml
new file mode 100644
index 00000000000..c86b9bd40f8
--- /dev/null
+++ b/changelogs/unreleased/security-trigger-system-hook-by-post.yml
@@ -0,0 +1,5 @@
+---
+title: Require POST request to trigger system hooks
+merge_request:
+author:
+type: security
diff --git a/doc/api/system_hooks.md b/doc/api/system_hooks.md
index 855436864cc..3348157129d 100644
--- a/doc/api/system_hooks.md
+++ b/doc/api/system_hooks.md
@@ -88,7 +88,7 @@ Example response:
## Test system hook
```plaintext
-GET /hooks/:id
+POST /hooks/:id
```
| Attribute | Type | Required | Description |
@@ -98,7 +98,7 @@ GET /hooks/:id
Example request:
```shell
-curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/hooks/2"
+curl --request POST --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/hooks/1"
```
Example response:
diff --git a/lib/api/system_hooks.rb b/lib/api/system_hooks.rb
index 42e16d47a0b..fe23a111b7f 100644
--- a/lib/api/system_hooks.rb
+++ b/lib/api/system_hooks.rb
@@ -47,7 +47,7 @@ module API
params do
requires :id, type: Integer, desc: 'The ID of the system hook'
end
- get ":id" do
+ post ":id" do
hook = SystemHook.find(params[:id])
data = {
event_name: "project_create",
diff --git a/spec/factories/pool_repositories.rb b/spec/factories/pool_repositories.rb
index f0905d28c70..f3f3e33189b 100644
--- a/spec/factories/pool_repositories.rb
+++ b/spec/factories/pool_repositories.rb
@@ -6,7 +6,7 @@ FactoryBot.define do
state { :none }
before(:create) do |pool|
- pool.source_project = create(:project, :repository)
+ pool.source_project ||= create(:project, :repository)
pool.source_project.update!(pool_repository: pool)
end
diff --git a/spec/requests/api/system_hooks_spec.rb b/spec/requests/api/system_hooks_spec.rb
index 01b46053d52..3cea1af686e 100644
--- a/spec/requests/api/system_hooks_spec.rb
+++ b/spec/requests/api/system_hooks_spec.rb
@@ -103,15 +103,15 @@ RSpec.describe API::SystemHooks do
end
end
- describe "GET /hooks/:id" do
- it "returns hook by id" do
- get api("/hooks/#{hook.id}", admin)
- expect(response).to have_gitlab_http_status(:ok)
+ describe 'POST /hooks/:id' do
+ it "returns and trigger hook by id" do
+ post api("/hooks/#{hook.id}", admin)
+ expect(response).to have_gitlab_http_status(:created)
expect(json_response['event_name']).to eq('project_create')
end
it "returns 404 on failure" do
- get api("/hooks/404", admin)
+ post api("/hooks/404", admin)
expect(response).to have_gitlab_http_status(:not_found)
end
end
diff --git a/spec/services/projects/fork_service_spec.rb b/spec/services/projects/fork_service_spec.rb
index df02f8ea15d..276656656ec 100644
--- a/spec/services/projects/fork_service_spec.rb
+++ b/spec/services/projects/fork_service_spec.rb
@@ -403,7 +403,7 @@ RSpec.describe Projects::ForkService do
end
context 'when forking with object pools' do
- let(:fork_from_project) { create(:project, :public) }
+ let(:fork_from_project) { create(:project, :repository, :public) }
let(:forker) { create(:user) }
context 'when no pool exists' do
diff --git a/spec/services/projects/unlink_fork_service_spec.rb b/spec/services/projects/unlink_fork_service_spec.rb
index 2a8965e62ce..90def365fca 100644
--- a/spec/services/projects/unlink_fork_service_spec.rb
+++ b/spec/services/projects/unlink_fork_service_spec.rb
@@ -207,6 +207,17 @@ RSpec.describe Projects::UnlinkForkService, :use_clean_rails_memory_store_cachin
end
end
+ context 'a project with pool repository' do
+ let(:project) { create(:project, :public, :repository) }
+ let!(:pool_repository) { create(:pool_repository, :ready, source_project: project) }
+
+ subject { described_class.new(project, user) }
+
+ it 'when unlinked leaves pool repository' do
+ expect { subject.execute }.to change { project.reload.has_pool_repository? }.from(true).to(false)
+ end
+ end
+
context 'when given project is not part of a fork network' do
let!(:project_without_forks) { create(:project, :public) }