Commit 2450625b authored by Rémy Coutable's avatar Rémy Coutable

Merge branch '22417-api-fork-fix' into 'master'

API: Return 404 when trying to fork to unaccessible namespace

Closes #22417

See merge request !6452
parents a41df736 74581261
...@@ -207,7 +207,9 @@ module API ...@@ -207,7 +207,9 @@ module API
if namespace_id.present? if namespace_id.present?
namespace = Namespace.find_by(id: namespace_id) || Namespace.find_by_path_or_name(namespace_id) namespace = Namespace.find_by(id: namespace_id) || Namespace.find_by_path_or_name(namespace_id)
not_found!('Target Namespace') unless namespace unless namespace && can?(current_user, :create_projects, namespace)
not_found!('Target Namespace')
end
attrs[:namespace] = namespace attrs[:namespace] = namespace
end end
......
...@@ -94,7 +94,7 @@ describe API::API, api: true do ...@@ -94,7 +94,7 @@ describe API::API, api: true do
it 'fails if trying to fork to another user when not admin' do it 'fails if trying to fork to another user when not admin' do
post api("/projects/fork/#{project.id}", user2), namespace: admin.namespace.id post api("/projects/fork/#{project.id}", user2), namespace: admin.namespace.id
expect(response).to have_http_status(409) expect(response).to have_http_status(404)
end end
it 'fails if trying to fork to non-existent namespace' do it 'fails if trying to fork to non-existent namespace' do
...@@ -114,7 +114,7 @@ describe API::API, api: true do ...@@ -114,7 +114,7 @@ describe API::API, api: true do
it 'fails to fork to not owned group' do it 'fails to fork to not owned group' do
post api("/projects/fork/#{project.id}", user2), namespace: group.name post api("/projects/fork/#{project.id}", user2), namespace: group.name
expect(response).to have_http_status(409) expect(response).to have_http_status(404)
end end
it 'forks to not owned group when admin' do it 'forks to not owned group when admin' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment