Commit fd3e41f1 authored by Douwe Maan's avatar Douwe Maan Committed by Robert Speicher

Merge branch 'fix/import-permissions' into 'master'

Set permissions to admin for importing a project via Import/Export

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/20802

In order to import a project, it is now required to be an admin

Moved from https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5766

See merge request !1983
(cherry picked from commit 966b3038)
parent 4389f09e
...@@ -3,6 +3,7 @@ Please view this file on the master branch, on stable branches it's out of date. ...@@ -3,6 +3,7 @@ Please view this file on the master branch, on stable branches it's out of date.
v 8.10.6 v 8.10.6
- Upgrade Rails to 4.2.7.1 for security fixes. !5781 - Upgrade Rails to 4.2.7.1 for security fixes. !5781
- Fix privilege escalation via project export. - Fix privilege escalation via project export.
- Require administrator privileges to perform a project import.
v 8.10.5 v 8.10.5
- Add a data migration to fix some missing timestamps in the members table. !5670 - Add a data migration to fix some missing timestamps in the members table. !5670
......
class Import::GitlabProjectsController < Import::BaseController class Import::GitlabProjectsController < Import::BaseController
before_action :verify_gitlab_project_import_enabled before_action :verify_gitlab_project_import_enabled
before_action :authenticate_admin!
def new def new
@namespace_id = project_params[:namespace_id] @namespace_id = project_params[:namespace_id]
...@@ -47,4 +48,8 @@ class Import::GitlabProjectsController < Import::BaseController ...@@ -47,4 +48,8 @@ class Import::GitlabProjectsController < Import::BaseController
:path, :namespace_id, :file :path, :namespace_id, :file
) )
end end
def authenticate_admin!
render_404 unless current_user.is_admin?
end
end end
...@@ -90,7 +90,7 @@ ...@@ -90,7 +90,7 @@
%i.fa.fa-git %i.fa.fa-git
%span Repo by URL %span Repo by URL
%div{ class: 'import_gitlab_project' } %div{ class: 'import_gitlab_project' }
- if gitlab_project_import_enabled? - if gitlab_project_import_enabled? && current_user.is_admin?
= link_to new_import_gitlab_project_path, class: 'btn btn_import_gitlab_project project-submit' do = link_to new_import_gitlab_project_path, class: 'btn btn_import_gitlab_project project-submit' do
%i.fa.fa-gitlab %i.fa.fa-gitlab
%span GitLab export %span GitLab export
......
...@@ -6,8 +6,7 @@ ...@@ -6,8 +6,7 @@
than that of the exporter. than that of the exporter.
- For existing installations, the project import option has to be enabled in - For existing installations, the project import option has to be enabled in
application settings (`/admin/application_settings`) under 'Import sources'. application settings (`/admin/application_settings`) under 'Import sources'.
Ask your administrator if you don't see the **GitLab export** button when You will have to be an administrator to enable and use the import functionality.
creating a new project.
- You can find some useful raketasks if you are an administrator in the - You can find some useful raketasks if you are an administrator in the
[import_export](../../../administration/raketasks/project_import_export.md) [import_export](../../../administration/raketasks/project_import_export.md)
raketask. raketask.
......
...@@ -9,7 +9,7 @@ Background: ...@@ -9,7 +9,7 @@ Background:
@javascript @javascript
Scenario: I should see New Projects page Scenario: I should see New Projects page
Then I see "New Project" page Then I see "New Project" page
Then I see all possible import optios Then I see all possible import options
@javascript @javascript
Scenario: I should see instructions on how to import from Git URL Scenario: I should see instructions on how to import from Git URL
......
...@@ -14,14 +14,13 @@ class Spinach::Features::NewProject < Spinach::FeatureSteps ...@@ -14,14 +14,13 @@ class Spinach::Features::NewProject < Spinach::FeatureSteps
expect(page).to have_content('Project name') expect(page).to have_content('Project name')
end end
step 'I see all possible import optios' do step 'I see all possible import options' do
expect(page).to have_link('GitHub') expect(page).to have_link('GitHub')
expect(page).to have_link('Bitbucket') expect(page).to have_link('Bitbucket')
expect(page).to have_link('GitLab.com') expect(page).to have_link('GitLab.com')
expect(page).to have_link('Gitorious.org') expect(page).to have_link('Gitorious.org')
expect(page).to have_link('Google Code') expect(page).to have_link('Google Code')
expect(page).to have_link('Repo by URL') expect(page).to have_link('Repo by URL')
expect(page).to have_link('GitLab export')
end end
step 'I click on "Import project from GitHub"' do step 'I click on "Import project from GitHub"' do
......
...@@ -3,8 +3,9 @@ require 'spec_helper' ...@@ -3,8 +3,9 @@ require 'spec_helper'
feature 'project import', feature: true, js: true do feature 'project import', feature: true, js: true do
include Select2Helper include Select2Helper
let(:user) { create(:admin) } let(:admin) { create(:admin) }
let!(:namespace) { create(:namespace, name: "asd", owner: user) } let(:normal_user) { create(:user) }
let!(:namespace) { create(:namespace, name: "asd", owner: admin) }
let(:file) { File.join(Rails.root, 'spec', 'features', 'projects', 'import_export', 'test_project_export.tar.gz') } let(:file) { File.join(Rails.root, 'spec', 'features', 'projects', 'import_export', 'test_project_export.tar.gz') }
let(:export_path) { "#{Dir::tmpdir}/import_file_spec" } let(:export_path) { "#{Dir::tmpdir}/import_file_spec" }
let(:project) { Project.last } let(:project) { Project.last }
...@@ -12,13 +13,17 @@ feature 'project import', feature: true, js: true do ...@@ -12,13 +13,17 @@ feature 'project import', feature: true, js: true do
background do background do
allow_any_instance_of(Gitlab::ImportExport).to receive(:storage_path).and_return(export_path) allow_any_instance_of(Gitlab::ImportExport).to receive(:storage_path).and_return(export_path)
login_as(user)
end end
after(:each) do after(:each) do
FileUtils.rm_rf(export_path, secure: true) FileUtils.rm_rf(export_path, secure: true)
end end
context 'admin user' do
before do
login_as(admin)
end
scenario 'user imports an exported project successfully' do scenario 'user imports an exported project successfully' do
expect(Project.all.count).to be_zero expect(Project.all.count).to be_zero
...@@ -74,6 +79,23 @@ feature 'project import', feature: true, js: true do ...@@ -74,6 +79,23 @@ feature 'project import', feature: true, js: true do
expect(page).to have_content('Please enter path and name') expect(page).to have_content('Please enter path and name')
end end
end end
end
context 'normal user' do
before do
login_as(normal_user)
end
scenario 'non-admin user is not allowed to import a project' do
expect(Project.all.count).to be_zero
visit new_project_path
fill_in :project_path, with: 'test-project-path', visible: true
expect(page).not_to have_content('GitLab export')
end
end
def wiki_exists? def wiki_exists?
wiki = ProjectWiki.new(project) wiki = ProjectWiki.new(project)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment