Commit 454d227b authored by Robert Speicher's avatar Robert Speicher

Remove all permission checking from Reference filters

parent afb2e6f4
...@@ -13,18 +13,11 @@ module Gitlab ...@@ -13,18 +13,11 @@ module Gitlab
# #
# ref - String reference. # ref - String reference.
# #
# Returns a Project, or nil if the reference can't be accessed # Returns a Project, or nil if the reference can't be found
def project_from_ref(ref) def project_from_ref(ref)
return context[:project] unless ref return context[:project] unless ref
other = Project.find_with_namespace(ref) Project.find_with_namespace(ref)
return nil unless other && user_can_reference_project?(other)
other
end
def user_can_reference_project?(project, user = context[:current_user])
Ability.abilities.allowed?(user, :read_project, project)
end end
end end
end end
......
...@@ -80,8 +80,6 @@ module Gitlab ...@@ -80,8 +80,6 @@ module Gitlab
end end
def link_to_group(group, namespace) def link_to_group(group, namespace)
return unless user_can_reference_group?(namespace)
push_result(:user, *namespace.users) push_result(:user, *namespace.users)
url = urls.group_url(group, only_path: context[:only_path]) url = urls.group_url(group, only_path: context[:only_path])
...@@ -100,10 +98,6 @@ module Gitlab ...@@ -100,10 +98,6 @@ module Gitlab
text = User.reference_prefix + user text = User.reference_prefix + user
%(<a href="#{url}" #{data} class="#{link_class}">#{text}</a>) %(<a href="#{url}" #{data} class="#{link_class}">#{text}</a>)
end end
def user_can_reference_group?(group)
Ability.abilities.allowed?(context[:current_user], :read_group, group)
end
end end
end end
end end
...@@ -106,45 +106,31 @@ module Gitlab::Markdown ...@@ -106,45 +106,31 @@ module Gitlab::Markdown
range.project = project2 range.project = project2
end end
context 'when user can access reference' do it 'links to a valid reference' do
before { allow_cross_reference! } doc = filter("See #{reference}")
it 'links to a valid reference' do
doc = filter("See #{reference}")
expect(doc.css('a').first.attr('href')).
to eq urls.namespace_project_compare_url(project2.namespace, project2, range.to_param)
end
it 'links with adjacent text' do
doc = filter("Fixed (#{reference}.)")
exp = Regexp.escape("#{project2.to_reference}@#{range.to_s}")
expect(doc.to_html).to match(/\(<a.+>#{exp}<\/a>\.\)/)
end
it 'ignores invalid commit IDs on the referenced project' do expect(doc.css('a').first.attr('href')).
exp = act = "Fixed #{project2.to_reference}@#{commit1.id.reverse}...#{commit2.id}" to eq urls.namespace_project_compare_url(project2.namespace, project2, range.to_param)
expect(filter(act).to_html).to eq exp end
exp = act = "Fixed #{project2.to_reference}@#{commit1.id}...#{commit2.id.reverse}" it 'links with adjacent text' do
expect(filter(act).to_html).to eq exp doc = filter("Fixed (#{reference}.)")
end
it 'adds to the results hash' do exp = Regexp.escape("#{project2.to_reference}@#{range.to_s}")
result = pipeline_result("See #{reference}") expect(doc.to_html).to match(/\(<a.+>#{exp}<\/a>\.\)/)
expect(result[:references][:commit_range]).not_to be_empty
end
end end
context 'when user cannot access reference' do it 'ignores invalid commit IDs on the referenced project' do
before { disallow_cross_reference! } exp = act = "Fixed #{project2.to_reference}@#{commit1.id.reverse}...#{commit2.id}"
expect(filter(act).to_html).to eq exp
it 'ignores valid references' do exp = act = "Fixed #{project2.to_reference}@#{commit1.id}...#{commit2.id.reverse}"
exp = act = "See #{reference}" expect(filter(act).to_html).to eq exp
end
expect(filter(act).to_html).to eq exp it 'adds to the results hash' do
end result = pipeline_result("See #{reference}")
expect(result[:references][:commit_range]).not_to be_empty
end end
end end
end end
......
...@@ -99,42 +99,28 @@ module Gitlab::Markdown ...@@ -99,42 +99,28 @@ module Gitlab::Markdown
let(:commit) { project2.commit } let(:commit) { project2.commit }
let(:reference) { commit.to_reference(project) } let(:reference) { commit.to_reference(project) }
context 'when user can access reference' do it 'links to a valid reference' do
before { allow_cross_reference! } doc = filter("See #{reference}")
it 'links to a valid reference' do
doc = filter("See #{reference}")
expect(doc.css('a').first.attr('href')).
to eq urls.namespace_project_commit_url(project2.namespace, project2, commit.id)
end
it 'links with adjacent text' do
doc = filter("Fixed (#{reference}.)")
exp = Regexp.escape(project2.to_reference) expect(doc.css('a').first.attr('href')).
expect(doc.to_html).to match(/\(<a.+>#{exp}@#{commit.short_id}<\/a>\.\)/) to eq urls.namespace_project_commit_url(project2.namespace, project2, commit.id)
end end
it 'ignores invalid commit IDs on the referenced project' do it 'links with adjacent text' do
exp = act = "Committed #{invalidate_reference(reference)}" doc = filter("Fixed (#{reference}.)")
expect(filter(act).to_html).to eq exp
end
it 'adds to the results hash' do exp = Regexp.escape(project2.to_reference)
result = pipeline_result("See #{reference}") expect(doc.to_html).to match(/\(<a.+>#{exp}@#{commit.short_id}<\/a>\.\)/)
expect(result[:references][:commit]).not_to be_empty
end
end end
context 'when user cannot access reference' do it 'ignores invalid commit IDs on the referenced project' do
before { disallow_cross_reference! } exp = act = "Committed #{invalidate_reference(reference)}"
expect(filter(act).to_html).to eq exp
it 'ignores valid references' do end
exp = act = "See #{reference}"
expect(filter(act).to_html).to eq exp it 'adds to the results hash' do
end result = pipeline_result("See #{reference}")
expect(result[:references][:commit]).not_to be_empty
end end
end end
end end
......
...@@ -35,21 +35,9 @@ module Gitlab::Markdown ...@@ -35,21 +35,9 @@ module Gitlab::Markdown
context 'and the user has permission to read it' do context 'and the user has permission to read it' do
it 'returns the referenced project' do it 'returns the referenced project' do
expect(self).to receive(:user_can_reference_project?).
with(project2).and_return(true)
expect(project_from_ref('cross/reference')).to eq project2 expect(project_from_ref('cross/reference')).to eq project2
end end
end end
context 'and the user does not have permission to read it' do
it 'returns nil' do
expect(self).to receive(:user_can_reference_project?).
with(project2).and_return(false)
expect(project_from_ref('cross/reference')).to be_nil
end
end
end end
end end
end end
......
...@@ -96,49 +96,35 @@ module Gitlab::Markdown ...@@ -96,49 +96,35 @@ module Gitlab::Markdown
let(:issue) { create(:issue, project: project2) } let(:issue) { create(:issue, project: project2) }
let(:reference) { issue.to_reference(project) } let(:reference) { issue.to_reference(project) }
context 'when user can access reference' do it 'ignores valid references when cross-reference project uses external tracker' do
before { allow_cross_reference! } expect_any_instance_of(Project).to receive(:get_issue).
with(issue.iid).and_return(nil)
it 'ignores valid references when cross-reference project uses external tracker' do exp = act = "Issue #{reference}"
expect_any_instance_of(Project).to receive(:get_issue). expect(filter(act).to_html).to eq exp
with(issue.iid).and_return(nil) end
exp = act = "Issue #{reference}"
expect(filter(act).to_html).to eq exp
end
it 'links to a valid reference' do
doc = filter("See #{reference}")
expect(doc.css('a').first.attr('href')).
to eq helper.url_for_issue(issue.iid, project2)
end
it 'links with adjacent text' do
doc = filter("Fixed (#{reference}.)")
expect(doc.to_html).to match(/\(<a.+>#{Regexp.escape(reference)}<\/a>\.\)/)
end
it 'ignores invalid issue IDs on the referenced project' do it 'links to a valid reference' do
exp = act = "Fixed #{invalidate_reference(reference)}" doc = filter("See #{reference}")
expect(filter(act).to_html).to eq exp expect(doc.css('a').first.attr('href')).
end to eq helper.url_for_issue(issue.iid, project2)
end
it 'adds to the results hash' do it 'links with adjacent text' do
result = pipeline_result("Fixed #{reference}") doc = filter("Fixed (#{reference}.)")
expect(result[:references][:issue]).to eq [issue] expect(doc.to_html).to match(/\(<a.+>#{Regexp.escape(reference)}<\/a>\.\)/)
end
end end
context 'when user cannot access reference' do it 'ignores invalid issue IDs on the referenced project' do
before { disallow_cross_reference! } exp = act = "Fixed #{invalidate_reference(reference)}"
it 'ignores valid references' do expect(filter(act).to_html).to eq exp
exp = act = "See #{reference}" end
expect(filter(act).to_html).to eq exp it 'adds to the results hash' do
end result = pipeline_result("Fixed #{reference}")
expect(result[:references][:issue]).to eq [issue]
end end
end end
end end
......
...@@ -84,42 +84,28 @@ module Gitlab::Markdown ...@@ -84,42 +84,28 @@ module Gitlab::Markdown
let(:merge) { create(:merge_request, source_project: project2) } let(:merge) { create(:merge_request, source_project: project2) }
let(:reference) { merge.to_reference(project) } let(:reference) { merge.to_reference(project) }
context 'when user can access reference' do it 'links to a valid reference' do
before { allow_cross_reference! } doc = filter("See #{reference}")
it 'links to a valid reference' do
doc = filter("See #{reference}")
expect(doc.css('a').first.attr('href')).
to eq urls.namespace_project_merge_request_url(project2.namespace,
project, merge)
end
it 'links with adjacent text' do
doc = filter("Merge (#{reference}.)")
expect(doc.to_html).to match(/\(<a.+>#{Regexp.escape(reference)}<\/a>\.\)/)
end
it 'ignores invalid merge IDs on the referenced project' do
exp = act = "Merge #{invalidate_reference(reference)}"
expect(filter(act).to_html).to eq exp expect(doc.css('a').first.attr('href')).
end to eq urls.namespace_project_merge_request_url(project2.namespace,
project, merge)
end
it 'adds to the results hash' do it 'links with adjacent text' do
result = pipeline_result("Merge #{reference}") doc = filter("Merge (#{reference}.)")
expect(result[:references][:merge_request]).to eq [merge] expect(doc.to_html).to match(/\(<a.+>#{Regexp.escape(reference)}<\/a>\.\)/)
end
end end
context 'when user cannot access reference' do it 'ignores invalid merge IDs on the referenced project' do
before { disallow_cross_reference! } exp = act = "Merge #{invalidate_reference(reference)}"
it 'ignores valid references' do expect(filter(act).to_html).to eq exp
exp = act = "See #{reference}" end
expect(filter(act).to_html).to eq exp it 'adds to the results hash' do
end result = pipeline_result("Merge #{reference}")
expect(result[:references][:merge_request]).to eq [merge]
end end
end end
end end
......
...@@ -83,41 +83,27 @@ module Gitlab::Markdown ...@@ -83,41 +83,27 @@ module Gitlab::Markdown
let(:snippet) { create(:project_snippet, project: project2) } let(:snippet) { create(:project_snippet, project: project2) }
let(:reference) { snippet.to_reference(project) } let(:reference) { snippet.to_reference(project) }
context 'when user can access reference' do it 'links to a valid reference' do
before { allow_cross_reference! } doc = filter("See #{reference}")
it 'links to a valid reference' do
doc = filter("See #{reference}")
expect(doc.css('a').first.attr('href')).
to eq urls.namespace_project_snippet_url(project2.namespace, project2, snippet)
end
it 'links with adjacent text' do
doc = filter("See (#{reference}.)")
expect(doc.to_html).to match(/\(<a.+>#{Regexp.escape(reference)}<\/a>\.\)/)
end
it 'ignores invalid snippet IDs on the referenced project' do
exp = act = "See #{invalidate_reference(reference)}"
expect(filter(act).to_html).to eq exp expect(doc.css('a').first.attr('href')).
end to eq urls.namespace_project_snippet_url(project2.namespace, project2, snippet)
end
it 'adds to the results hash' do it 'links with adjacent text' do
result = pipeline_result("Snippet #{reference}") doc = filter("See (#{reference}.)")
expect(result[:references][:snippet]).to eq [snippet] expect(doc.to_html).to match(/\(<a.+>#{Regexp.escape(reference)}<\/a>\.\)/)
end
end end
context 'when user cannot access reference' do it 'ignores invalid snippet IDs on the referenced project' do
before { disallow_cross_reference! } exp = act = "See #{invalidate_reference(reference)}"
it 'ignores valid references' do expect(filter(act).to_html).to eq exp
exp = act = "See #{reference}" end
expect(filter(act).to_html).to eq exp it 'adds to the results hash' do
end result = pipeline_result("Snippet #{reference}")
expect(result[:references][:snippet]).to eq [snippet]
end end
end end
end end
......
...@@ -83,40 +83,26 @@ module Gitlab::Markdown ...@@ -83,40 +83,26 @@ module Gitlab::Markdown
let(:user) { create(:user) } let(:user) { create(:user) }
let(:reference) { group.to_reference } let(:reference) { group.to_reference }
context 'that the current user can read' do before do
before do group.add_developer(user)
group.add_developer(user) end
end
it 'links to the Group' do
it 'links to the Group' do doc = filter("Hey #{reference}", current_user: user)
doc = filter("Hey #{reference}", current_user: user) expect(doc.css('a').first.attr('href')).to eq urls.group_url(group)
expect(doc.css('a').first.attr('href')).to eq urls.group_url(group)
end
it 'includes a data-group-id attribute' do
doc = filter("Hey #{reference}", current_user: user)
link = doc.css('a').first
expect(link).to have_attribute('data-group-id')
expect(link.attr('data-group-id')).to eq group.id.to_s
end
it 'adds to the results hash' do
result = pipeline_result("Hey #{reference}", current_user: user)
expect(result[:references][:user]).to eq group.users
end
end end
context 'that the current user cannot read' do it 'includes a data-group-id attribute' do
it 'ignores references to the Group' do doc = filter("Hey #{reference}", current_user: user)
doc = filter("Hey #{reference}", current_user: user) link = doc.css('a').first
expect(doc.to_html).to eq "Hey #{reference}"
end
it 'does not add to the results hash' do expect(link).to have_attribute('data-group-id')
result = pipeline_result("Hey #{reference}", current_user: user) expect(link.attr('data-group-id')).to eq group.id.to_s
expect(result[:references][:user]).to eq [] end
end
it 'adds to the results hash' do
result = pipeline_result("Hey #{reference}", current_user: user)
expect(result[:references][:user]).to eq group.users
end end
end end
......
...@@ -55,20 +55,6 @@ module FilterSpecHelper ...@@ -55,20 +55,6 @@ module FilterSpecHelper
end end
end end
# Stub CrossProjectReference#user_can_reference_project? to return true for
# the current test
def allow_cross_reference!
allow_any_instance_of(described_class).
to receive(:user_can_reference_project?).and_return(true)
end
# Stub CrossProjectReference#user_can_reference_project? to return false for
# the current test
def disallow_cross_reference!
allow_any_instance_of(described_class).
to receive(:user_can_reference_project?).and_return(false)
end
# Shortcut to Rails' auto-generated routes helpers, to avoid including the # Shortcut to Rails' auto-generated routes helpers, to avoid including the
# module # module
def urls def urls
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment