Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
G
gitlab-ce
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Boxiang Sun
gitlab-ce
Commits
38074307
Commit
38074307
authored
Aug 26, 2019
by
charlieablett
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Users without commit access cannot create notes
parent
d793ddc5
Changes
2
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
37 additions
and
12 deletions
+37
-12
app/policies/commit_policy.rb
app/policies/commit_policy.rb
+1
-0
spec/policies/commit_policy_spec.rb
spec/policies/commit_policy_spec.rb
+36
-12
No files found.
app/policies/commit_policy.rb
View file @
38074307
...
...
@@ -4,4 +4,5 @@ class CommitPolicy < BasePolicy
delegate
{
@subject
.
project
}
rule
{
can?
(
:download_code
)
}.
enable
:read_commit
rule
{
~
can?
(
:read_commit
)
}.
prevent
:create_note
end
spec/policies/commit_policy_spec.rb
View file @
38074307
...
...
@@ -8,28 +8,42 @@ describe CommitPolicy do
let
(
:commit
)
{
project
.
repository
.
head_commit
}
let
(
:policy
)
{
described_class
.
new
(
user
,
commit
)
}
shared_examples
'can read commit and create a note'
do
it
'can read commit'
do
expect
(
policy
).
to
be_allowed
(
:read_commit
)
end
it
'can create a note'
do
expect
(
policy
).
to
be_allowed
(
:create_note
)
end
end
shared_examples
'cannot read commit nor create a note'
do
it
'can not read commit'
do
expect
(
policy
).
to
be_disallowed
(
:read_commit
)
end
it
'can not create a note'
do
expect
(
policy
).
to
be_disallowed
(
:create_note
)
end
end
context
'when project is public'
do
let
(
:project
)
{
create
(
:project
,
:public
,
:repository
)
}
it
'can read commit and create a note'
do
expect
(
policy
).
to
be_allowed
(
:read_commit
)
end
it_behaves_like
'can read commit and create a note'
context
'when repository access level is private'
do
let
(
:project
)
{
create
(
:project
,
:public
,
:repository
,
:repository_private
)
}
it
'can not read commit and create a note'
do
expect
(
policy
).
to
be_disallowed
(
:read_commit
)
end
it_behaves_like
'cannot read commit nor create a note'
context
'when the user is a project member'
do
before
do
project
.
add_developer
(
user
)
end
it
'can read commit and create a note'
do
expect
(
policy
).
to
be_allowed
(
:read_commit
)
end
it_behaves_like
'can read commit and create a note'
end
end
end
...
...
@@ -37,9 +51,7 @@ describe CommitPolicy do
context
'when project is private'
do
let
(
:project
)
{
create
(
:project
,
:private
,
:repository
)
}
it
'can not read commit and create a note'
do
expect
(
policy
).
to
be_disallowed
(
:read_commit
)
end
it_behaves_like
'cannot read commit nor create a note'
context
'when the user is a project member'
do
before
do
...
...
@@ -50,6 +62,18 @@ describe CommitPolicy do
expect
(
policy
).
to
be_allowed
(
:read_commit
)
end
end
context
'when the user is a guest'
do
before
do
project
.
add_guest
(
user
)
end
it_behaves_like
'cannot read commit nor create a note'
it
'cannot download code'
do
expect
(
policy
).
to
be_disallowed
(
:download_code
)
end
end
end
end
end
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment