From 6c57734677746aa0e6695aa75990a85a7f95b50d Mon Sep 17 00:00:00 2001 From: Michael Kozono Date: Fri, 1 Sep 2017 18:00:46 -0700 Subject: Enforce share_with_group_lock rules MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit …in Groups::UpdateService instead of only in the browser. --- app/services/groups/update_service.rb | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) (limited to 'app/services') diff --git a/app/services/groups/update_service.rb b/app/services/groups/update_service.rb index 1d65c76d282..45716c63cfc 100644 --- a/app/services/groups/update_service.rb +++ b/app/services/groups/update_service.rb @@ -10,10 +10,12 @@ module Groups Gitlab::VisibilityLevel.allowed_for?(current_user, new_visibility) deny_visibility_level(group, new_visibility) - return group + return false end end + return false unless valid_share_with_group_lock_change? + group.assign_attributes(params) begin @@ -30,5 +32,19 @@ module Groups def reject_parent_id! params.except!(:parent_id) end + + def valid_share_with_group_lock_change? + return true unless changing_share_with_group_lock? + return true if can?(current_user, :change_share_with_group_lock, group) + + group.errors.add(:share_with_group_lock, 'cannot be disabled when the parent group Share lock is enabled, except by the owner of the parent group') + false + end + + def changing_share_with_group_lock? + return false if params[:share_with_group_lock].nil? + + params[:share_with_group_lock] != group.share_with_group_lock + end end end -- cgit v1.2.1