summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
Diffstat (limited to 'lib')
-rw-r--r--lib/api/lint.rb4
-rw-r--r--lib/api/merge_request_approvals.rb2
-rw-r--r--lib/api/merge_request_diffs.rb4
-rw-r--r--lib/api/merge_requests.rb11
-rw-r--r--lib/api/todos.rb5
-rw-r--r--lib/gitlab/auth/otp/strategies/forti_token_cloud.rb3
-rw-r--r--lib/gitlab/ci/pipeline/chain/validate/abilities.rb4
-rw-r--r--lib/gitlab/tree_summary.rb51
8 files changed, 60 insertions, 24 deletions
diff --git a/lib/api/lint.rb b/lib/api/lint.rb
index 58181adaa93..c65c52e3054 100644
--- a/lib/api/lint.rb
+++ b/lib/api/lint.rb
@@ -11,6 +11,8 @@ module API
optional :include_merged_yaml, type: Boolean, desc: 'Whether or not to include merged CI config yaml in the response'
end
post '/lint' do
+ unauthorized! unless Gitlab::CurrentSettings.signup_enabled? && current_user
+
result = Gitlab::Ci::YamlProcessor.new(params[:content], user: current_user).execute
error = result.errors.first
@@ -56,7 +58,7 @@ module API
optional :dry_run, type: Boolean, default: false, desc: 'Run pipeline creation simulation, or only do static check.'
end
post ':id/ci/lint' do
- authorize! :download_code, user_project
+ authorize! :create_pipeline, user_project
result = Gitlab::Ci::Lint
.new(project: user_project, current_user: current_user)
diff --git a/lib/api/merge_request_approvals.rb b/lib/api/merge_request_approvals.rb
index 00f42703731..0cdfd8f94b4 100644
--- a/lib/api/merge_request_approvals.rb
+++ b/lib/api/merge_request_approvals.rb
@@ -26,6 +26,8 @@ module API
# GET /projects/:id/merge_requests/:merge_request_iid/approvals
desc 'List approvals for merge request'
get 'approvals' do
+ not_found!("Merge Request") unless can?(current_user, :read_merge_request, user_project)
+
merge_request = find_merge_request_with_access(params[:merge_request_iid])
present_approval(merge_request)
diff --git a/lib/api/merge_request_diffs.rb b/lib/api/merge_request_diffs.rb
index 0ffb38438eb..97a6c7075b3 100644
--- a/lib/api/merge_request_diffs.rb
+++ b/lib/api/merge_request_diffs.rb
@@ -23,6 +23,8 @@ module API
use :pagination
end
get ":id/merge_requests/:merge_request_iid/versions" do
+ not_found!("Merge Request") unless can?(current_user, :read_merge_request, user_project)
+
merge_request = find_merge_request_with_access(params[:merge_request_iid])
present paginate(merge_request.merge_request_diffs.order_id_desc), with: Entities::MergeRequestDiff
@@ -39,6 +41,8 @@ module API
end
get ":id/merge_requests/:merge_request_iid/versions/:version_id" do
+ not_found!("Merge Request") unless can?(current_user, :read_merge_request, user_project)
+
merge_request = find_merge_request_with_access(params[:merge_request_iid])
present merge_request.merge_request_diffs.find(params[:version_id]), with: Entities::MergeRequestDiffFull
diff --git a/lib/api/merge_requests.rb b/lib/api/merge_requests.rb
index ab0e9b95e4a..142ecd0dc1e 100644
--- a/lib/api/merge_requests.rb
+++ b/lib/api/merge_requests.rb
@@ -246,6 +246,8 @@ module API
success Entities::MergeRequest
end
get ':id/merge_requests/:merge_request_iid' do
+ not_found!("Merge Request") unless can?(current_user, :read_merge_request, user_project)
+
merge_request = find_merge_request_with_access(params[:merge_request_iid])
present merge_request,
@@ -262,7 +264,10 @@ module API
success Entities::UserBasic
end
get ':id/merge_requests/:merge_request_iid/participants' do
+ not_found!("Merge Request") unless can?(current_user, :read_merge_request, user_project)
+
merge_request = find_merge_request_with_access(params[:merge_request_iid])
+
participants = ::Kaminari.paginate_array(merge_request.participants)
present paginate(participants), with: Entities::UserBasic
@@ -272,6 +277,8 @@ module API
success Entities::Commit
end
get ':id/merge_requests/:merge_request_iid/commits' do
+ not_found!("Merge Request") unless can?(current_user, :read_merge_request, user_project)
+
merge_request = find_merge_request_with_access(params[:merge_request_iid])
commits =
@@ -353,6 +360,8 @@ module API
success Entities::MergeRequestChanges
end
get ':id/merge_requests/:merge_request_iid/changes' do
+ not_found!("Merge Request") unless can?(current_user, :read_merge_request, user_project)
+
merge_request = find_merge_request_with_access(params[:merge_request_iid])
present merge_request,
@@ -368,6 +377,8 @@ module API
get ':id/merge_requests/:merge_request_iid/pipelines' do
pipelines = merge_request_pipelines_with_access
+ not_found!("Merge Request") unless can?(current_user, :read_merge_request, user_project)
+
present paginate(pipelines), with: Entities::Ci::PipelineBasic
end
diff --git a/lib/api/todos.rb b/lib/api/todos.rb
index 03850ba1c4e..afc1525cbe2 100644
--- a/lib/api/todos.rb
+++ b/lib/api/todos.rb
@@ -28,6 +28,11 @@ module API
end
post ":id/#{type}/:#{type_id_str}/todo" do
issuable = instance_exec(params[type_id_str], &finder)
+
+ unless can?(current_user, :read_merge_request, issuable.project)
+ not_found!(type.split("_").map(&:capitalize).join(" "))
+ end
+
todo = TodoService.new.mark_todo(issuable, current_user).first
if todo
diff --git a/lib/gitlab/auth/otp/strategies/forti_token_cloud.rb b/lib/gitlab/auth/otp/strategies/forti_token_cloud.rb
index d7506eca242..079d631e22a 100644
--- a/lib/gitlab/auth/otp/strategies/forti_token_cloud.rb
+++ b/lib/gitlab/auth/otp/strategies/forti_token_cloud.rb
@@ -61,8 +61,7 @@ module Gitlab
headers: {
'Content-Type': 'application/json'
}.merge(headers),
- body: body,
- verify: false # FTC API Docs specifically mentions to turn off SSL Verification while making requests.
+ body: body
)
end
end
diff --git a/lib/gitlab/ci/pipeline/chain/validate/abilities.rb b/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
index 8f1e690c081..4f90b7756eb 100644
--- a/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
+++ b/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
@@ -10,6 +10,10 @@ module Gitlab
include Chain::Helpers
def perform!
+ if project.pending_delete?
+ return error('Project is deleted!')
+ end
+
unless project.builds_enabled?
return error('Pipelines are disabled!')
end
diff --git a/lib/gitlab/tree_summary.rb b/lib/gitlab/tree_summary.rb
index 9b67599668a..bc7b8bd2b94 100644
--- a/lib/gitlab/tree_summary.rb
+++ b/lib/gitlab/tree_summary.rb
@@ -40,21 +40,17 @@ module Gitlab
# - An Array of the unique ::Commit objects in the first value
def summarize
summary = contents
- .map { |content| build_entry(content) }
.tap { |summary| fill_last_commits!(summary) }
[summary, commits]
end
def fetch_logs
- cache_key = ['projects', project.id, 'logs', commit.id, path, offset]
- Rails.cache.fetch(cache_key, expires_in: CACHE_EXPIRE_IN) do
- logs, _ = summarize
+ logs, _ = summarize
- new_offset = next_offset if more?
+ new_offset = next_offset if more?
- [logs.as_json, new_offset]
- end
+ [logs.as_json, new_offset]
end
# Does the tree contain more entries after the given offset + limit?
@@ -71,7 +67,7 @@ module Gitlab
private
def contents
- all_contents[offset, limit]
+ all_contents[offset, limit] || []
end
def commits
@@ -82,22 +78,17 @@ module Gitlab
project.repository
end
- def entry_path(entry)
- File.join(*[path, entry[:file_name]].compact).force_encoding(Encoding::ASCII_8BIT)
+ # Ensure the path is in "path/" format
+ def ensured_path
+ File.join(*[path, ""]) if path
end
- def build_entry(entry)
- { file_name: entry.name, type: entry.type }
+ def entry_path(entry)
+ File.join(*[path, entry[:file_name]].compact).force_encoding(Encoding::ASCII_8BIT)
end
def fill_last_commits!(entries)
- # Ensure the path is in "path/" format
- ensured_path =
- if path
- File.join(*[path, ""])
- end
-
- commits_hsh = repository.list_last_commits_for_tree(commit.id, ensured_path, offset: offset, limit: limit, literal_pathspec: true)
+ commits_hsh = fetch_last_cached_commits_list
prerender_commit_full_titles!(commits_hsh.values)
entries.each do |entry|
@@ -112,6 +103,18 @@ module Gitlab
end
end
+ def fetch_last_cached_commits_list
+ cache_key = ['projects', project.id, 'last_commits_list', commit.id, ensured_path, offset, limit]
+
+ commits = Rails.cache.fetch(cache_key, expires_in: CACHE_EXPIRE_IN) do
+ repository
+ .list_last_commits_for_tree(commit.id, ensured_path, offset: offset, limit: limit, literal_pathspec: true)
+ .transform_values!(&:to_hash)
+ end
+
+ commits.transform_values! { |value| Commit.from_hash(value, project) }
+ end
+
def cache_commit(commit)
return unless commit.present?
@@ -123,12 +126,18 @@ module Gitlab
end
def all_contents
- strong_memoize(:all_contents) do
+ strong_memoize(:all_contents) { cached_contents }
+ end
+
+ def cached_contents
+ cache_key = ['projects', project.id, 'content', commit.id, path]
+
+ Rails.cache.fetch(cache_key, expires_in: CACHE_EXPIRE_IN) do
[
*tree.trees,
*tree.blobs,
*tree.submodules
- ]
+ ].map { |entry| { file_name: entry.name, type: entry.type } }
end
end
View Lorry Controller Status