diff options
| -rw-r--r-- | app/services/ci/pipeline_trigger_service.rb | 1 | ||||
| -rw-r--r-- | spec/services/ci/pipeline_trigger_service_spec.rb | 9 |
2 files changed, 10 insertions, 0 deletions
diff --git a/app/services/ci/pipeline_trigger_service.rb b/app/services/ci/pipeline_trigger_service.rb index 06eb1aee8e6..39ac9bf33e9 100644 --- a/app/services/ci/pipeline_trigger_service.rb +++ b/app/services/ci/pipeline_trigger_service.rb @@ -27,6 +27,7 @@ module Ci def create_pipeline_from_trigger(trigger) # this check is to not leak the presence of the project if user cannot read it return unless trigger.project == project + return unless can?(trigger.owner, :read_project, project) response = Ci::CreatePipelineService .new(project, trigger.owner, ref: params[:ref], variables_attributes: variables) diff --git a/spec/services/ci/pipeline_trigger_service_spec.rb b/spec/services/ci/pipeline_trigger_service_spec.rb index a794dedc658..4b3e774ff3c 100644 --- a/spec/services/ci/pipeline_trigger_service_spec.rb +++ b/spec/services/ci/pipeline_trigger_service_spec.rb @@ -56,6 +56,15 @@ RSpec.describe Ci::PipelineTriggerService do end end + context 'when trigger owner does not have a permission to read a project' do + let(:params) { { token: trigger.token, ref: 'master', variables: nil } } + let(:trigger) { create(:ci_trigger, project: project, owner: create(:user)) } + + it 'does nothing' do + expect { result }.not_to change { Ci::Pipeline.count } + end + end + context 'when params have an existing trigger token' do context 'when params have an existing ref' do let(:params) { { token: trigger.token, ref: 'master', variables: nil } } |