Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
G
gitlab-ce
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
1
Merge Requests
1
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
nexedi
gitlab-ce
Commits
740a54a6
Commit
740a54a6
authored
Feb 29, 2016
by
Douglas Barbosa Alexandre
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Restrict access to confidential issues on search results
parent
19ec6e58
Changes
6
Hide whitespace changes
Inline
Side-by-side
Showing
6 changed files
with
177 additions
and
8 deletions
+177
-8
app/services/search/global_service.rb
app/services/search/global_service.rb
+1
-1
app/services/search/project_service.rb
app/services/search/project_service.rb
+2
-1
lib/gitlab/project_search_results.rb
lib/gitlab/project_search_results.rb
+24
-1
lib/gitlab/search_results.rb
lib/gitlab/search_results.rb
+18
-2
spec/lib/gitlab/project_search_results_spec.rb
spec/lib/gitlab/project_search_results_spec.rb
+56
-2
spec/lib/gitlab/search_results_spec.rb
spec/lib/gitlab/search_results_spec.rb
+76
-1
No files found.
app/services/search/global_service.rb
View file @
740a54a6
...
@@ -14,7 +14,7 @@ module Search
...
@@ -14,7 +14,7 @@ module Search
if
Gitlab
.
config
.
elasticsearch
.
enabled
if
Gitlab
.
config
.
elasticsearch
.
enabled
Gitlab
::
Elastic
::
SearchResults
.
new
(
projects
.
pluck
(
:id
),
params
[
:search
])
Gitlab
::
Elastic
::
SearchResults
.
new
(
projects
.
pluck
(
:id
),
params
[
:search
])
else
else
Gitlab
::
SearchResults
.
new
(
projects
,
params
[
:search
])
Gitlab
::
SearchResults
.
new
(
current_user
,
projects
,
params
[
:search
])
end
end
end
end
end
end
...
...
app/services/search/project_service.rb
View file @
740a54a6
...
@@ -12,7 +12,8 @@ module Search
...
@@ -12,7 +12,8 @@ module Search
params
[
:search
],
params
[
:search
],
params
[
:repository_ref
])
params
[
:repository_ref
])
else
else
Gitlab
::
ProjectSearchResults
.
new
(
project
,
Gitlab
::
ProjectSearchResults
.
new
(
current_user
,
project
,
params
[
:search
],
params
[
:search
],
params
[
:repository_ref
])
params
[
:repository_ref
])
end
end
...
...
lib/gitlab/project_search_results.rb
View file @
740a54a6
...
@@ -2,7 +2,8 @@ module Gitlab
...
@@ -2,7 +2,8 @@ module Gitlab
class
ProjectSearchResults
<
SearchResults
class
ProjectSearchResults
<
SearchResults
attr_reader
:project
,
:repository_ref
attr_reader
:project
,
:repository_ref
def
initialize
(
project
,
query
,
repository_ref
=
nil
)
def
initialize
(
user
,
project
,
query
,
repository_ref
=
nil
)
@user
=
user
@project
=
project
@project
=
project
@repository_ref
=
if
repository_ref
.
present?
@repository_ref
=
if
repository_ref
.
present?
repository_ref
repository_ref
...
@@ -84,6 +85,28 @@ module Gitlab
...
@@ -84,6 +85,28 @@ module Gitlab
end
end
end
end
def
issues
issues
=
Issue
.
where
(
project_id:
project_ids_relation
)
unless
user
.
admin?
||
project
.
team
.
member?
(
user
.
id
)
issuable_table
=
issues
.
arel_table
issues
=
issues
.
where
(
issuable_table
[
:confidential
].
eq
(
false
).
or
(
issuable_table
[
:confidential
].
eq
(
true
).
and
(
issuable_table
[
:author_id
].
eq
(
user
.
id
))
)
)
end
if
query
=~
/#(\d+)\z/
issues
=
issues
.
where
(
iid:
$1
)
else
issues
=
issues
.
full_search
(
query
)
end
issues
.
order
(
'updated_at DESC'
)
end
def
project_ids_relation
def
project_ids_relation
project
project
end
end
...
...
lib/gitlab/search_results.rb
View file @
740a54a6
module
Gitlab
module
Gitlab
class
SearchResults
class
SearchResults
attr_reader
:query
attr_reader
:
user
,
:
query
# Limit search results by passed projects
# Limit search results by passed projects
# It allows us to search only for projects user has access to
# It allows us to search only for projects user has access to
attr_reader
:limit_projects
attr_reader
:limit_projects
def
initialize
(
limit_projects
,
query
)
def
initialize
(
user
,
limit_projects
,
query
)
@user
=
user
@limit_projects
=
limit_projects
||
Project
.
all
@limit_projects
=
limit_projects
||
Project
.
all
@query
=
Shellwords
.
shellescape
(
query
)
if
query
.
present?
@query
=
Shellwords
.
shellescape
(
query
)
if
query
.
present?
end
end
...
@@ -60,6 +61,21 @@ module Gitlab
...
@@ -60,6 +61,21 @@ module Gitlab
def
issues
def
issues
issues
=
Issue
.
where
(
project_id:
project_ids_relation
)
issues
=
Issue
.
where
(
project_id:
project_ids_relation
)
unless
user
.
admin?
issues_table
=
issues
.
arel_table
authorized_projects_ids
=
user
.
authorized_projects
.
pluck
(
:id
)
issues
=
issues
.
where
(
issues_table
[
:confidential
].
eq
(
false
).
or
(
issues_table
[
:confidential
].
eq
(
true
).
and
(
issues_table
[
:author_id
].
eq
(
user
.
id
).
or
(
issues_table
[
:project_id
].
in
(
authorized_projects_ids
)
)
)
)
)
end
if
query
=~
/#(\d+)\z/
if
query
=~
/#(\d+)\z/
issues
=
issues
.
where
(
iid:
$1
)
issues
=
issues
.
where
(
iid:
$1
)
else
else
...
...
spec/lib/gitlab/project_search_results_spec.rb
View file @
740a54a6
require
'spec_helper'
require
'spec_helper'
describe
Gitlab
::
ProjectSearchResults
,
lib:
true
do
describe
Gitlab
::
ProjectSearchResults
,
lib:
true
do
let
(
:user
)
{
create
(
:user
)
}
let
(
:project
)
{
create
(
:project
)
}
let
(
:project
)
{
create
(
:project
)
}
let
(
:query
)
{
'hello world'
}
let
(
:query
)
{
'hello world'
}
describe
'initialize with empty ref'
do
describe
'initialize with empty ref'
do
let
(
:results
)
{
Gitlab
::
ProjectSearchResults
.
new
(
project
,
query
,
''
)
}
let
(
:results
)
{
Gitlab
::
ProjectSearchResults
.
new
(
user
,
project
,
query
,
''
)
}
it
{
expect
(
results
.
project
).
to
eq
(
project
)
}
it
{
expect
(
results
.
project
).
to
eq
(
project
)
}
it
{
expect
(
results
.
repository_ref
).
to
be_nil
}
it
{
expect
(
results
.
repository_ref
).
to
be_nil
}
...
@@ -14,10 +15,63 @@ describe Gitlab::ProjectSearchResults, lib: true do
...
@@ -14,10 +15,63 @@ describe Gitlab::ProjectSearchResults, lib: true do
describe
'initialize with ref'
do
describe
'initialize with ref'
do
let
(
:ref
)
{
'refs/heads/test'
}
let
(
:ref
)
{
'refs/heads/test'
}
let
(
:results
)
{
Gitlab
::
ProjectSearchResults
.
new
(
project
,
query
,
ref
)
}
let
(
:results
)
{
Gitlab
::
ProjectSearchResults
.
new
(
user
,
project
,
query
,
ref
)
}
it
{
expect
(
results
.
project
).
to
eq
(
project
)
}
it
{
expect
(
results
.
project
).
to
eq
(
project
)
}
it
{
expect
(
results
.
repository_ref
).
to
eq
(
ref
)
}
it
{
expect
(
results
.
repository_ref
).
to
eq
(
ref
)
}
it
{
expect
(
results
.
query
).
to
eq
(
'hello world'
)
}
it
{
expect
(
results
.
query
).
to
eq
(
'hello world'
)
}
end
end
describe
'confidential issues'
do
let
(
:query
)
{
'issue'
}
let
(
:author
)
{
create
(
:user
)
}
let
(
:non_member
)
{
create
(
:user
)
}
let
(
:member
)
{
create
(
:user
)
}
let
(
:admin
)
{
create
(
:admin
)
}
let!
(
:issue
)
{
create
(
:issue
,
project:
project
,
title:
'Issue 1'
)
}
let!
(
:security_issue_1
)
{
create
(
:issue
,
:confidential
,
project:
project
,
title:
'Security issue 1'
,
author:
author
)
}
let!
(
:security_issue_2
)
{
create
(
:issue
,
:confidential
,
title:
'Security issue 2'
,
project:
project
)
}
it
'should not list project confidential issues for non project members'
do
results
=
described_class
.
new
(
non_member
,
project
,
query
)
issues
=
results
.
objects
(
'issues'
)
expect
(
issues
).
to
include
issue
expect
(
issues
).
not_to
include
security_issue_1
expect
(
issues
).
not_to
include
security_issue_2
expect
(
results
.
issues_count
).
to
eq
1
end
it
'should list project confidential issues for author'
do
results
=
described_class
.
new
(
author
,
project
,
query
)
issues
=
results
.
objects
(
'issues'
)
expect
(
issues
).
to
include
issue
expect
(
issues
).
to
include
security_issue_1
expect
(
issues
).
not_to
include
security_issue_2
expect
(
results
.
issues_count
).
to
eq
2
end
it
'should list project confidential issues for project members'
do
project
.
team
<<
[
member
,
:developer
]
results
=
described_class
.
new
(
member
,
project
,
query
)
issues
=
results
.
objects
(
'issues'
)
expect
(
issues
).
to
include
issue
expect
(
issues
).
to
include
security_issue_1
expect
(
issues
).
to
include
security_issue_2
expect
(
results
.
issues_count
).
to
eq
3
end
it
'should list all project issues for admin'
do
results
=
described_class
.
new
(
admin
,
project
,
query
)
issues
=
results
.
objects
(
'issues'
)
expect
(
issues
).
to
include
issue
expect
(
issues
).
to
include
security_issue_1
expect
(
issues
).
to
include
security_issue_2
expect
(
results
.
issues_count
).
to
eq
3
end
end
end
end
spec/lib/gitlab/search_results_spec.rb
View file @
740a54a6
require
'spec_helper'
require
'spec_helper'
describe
Gitlab
::
SearchResults
do
describe
Gitlab
::
SearchResults
do
let
(
:user
)
{
create
(
:user
)
}
let!
(
:project
)
{
create
(
:project
,
name:
'foo'
)
}
let!
(
:project
)
{
create
(
:project
,
name:
'foo'
)
}
let!
(
:issue
)
{
create
(
:issue
,
project:
project
,
title:
'foo'
)
}
let!
(
:issue
)
{
create
(
:issue
,
project:
project
,
title:
'foo'
)
}
...
@@ -9,7 +10,7 @@ describe Gitlab::SearchResults do
...
@@ -9,7 +10,7 @@ describe Gitlab::SearchResults do
end
end
let!
(
:milestone
)
{
create
(
:milestone
,
project:
project
,
title:
'foo'
)
}
let!
(
:milestone
)
{
create
(
:milestone
,
project:
project
,
title:
'foo'
)
}
let
(
:results
)
{
described_class
.
new
(
Project
.
all
,
'foo'
)
}
let
(
:results
)
{
described_class
.
new
(
user
,
Project
.
all
,
'foo'
)
}
describe
'#total_count'
do
describe
'#total_count'
do
it
'returns the total amount of search hits'
do
it
'returns the total amount of search hits'
do
...
@@ -52,4 +53,78 @@ describe Gitlab::SearchResults do
...
@@ -52,4 +53,78 @@ describe Gitlab::SearchResults do
expect
(
results
.
empty?
).
to
eq
(
false
)
expect
(
results
.
empty?
).
to
eq
(
false
)
end
end
end
end
describe
'confidential issues'
do
let
(
:project_1
)
{
create
(
:empty_project
)
}
let
(
:project_2
)
{
create
(
:empty_project
)
}
let
(
:project_3
)
{
create
(
:empty_project
)
}
let
(
:project_4
)
{
create
(
:empty_project
)
}
let
(
:query
)
{
'issue'
}
let
(
:limit_projects
)
{
Project
.
where
(
id:
[
project_1
.
id
,
project_2
.
id
,
project_3
.
id
])
}
let
(
:author
)
{
create
(
:user
)
}
let
(
:non_member
)
{
create
(
:user
)
}
let
(
:member
)
{
create
(
:user
)
}
let
(
:admin
)
{
create
(
:admin
)
}
let!
(
:issue
)
{
create
(
:issue
,
project:
project_1
,
title:
'Issue 1'
)
}
let!
(
:security_issue_1
)
{
create
(
:issue
,
:confidential
,
project:
project_1
,
title:
'Security issue 1'
,
author:
author
)
}
let!
(
:security_issue_2
)
{
create
(
:issue
,
:confidential
,
title:
'Security issue 2'
,
project:
project_1
)
}
let!
(
:security_issue_3
)
{
create
(
:issue
,
:confidential
,
project:
project_2
,
title:
'Security issue 3'
,
author:
author
)
}
let!
(
:security_issue_4
)
{
create
(
:issue
,
:confidential
,
project:
project_3
,
title:
'Security issue 4'
)
}
let!
(
:security_issue_5
)
{
create
(
:issue
,
:confidential
,
project:
project_4
,
title:
'Security issue 5'
)
}
it
'should not list confidential issues for non project members'
do
results
=
described_class
.
new
(
non_member
,
limit_projects
,
query
)
issues
=
results
.
objects
(
'issues'
)
expect
(
issues
).
to
include
issue
expect
(
issues
).
not_to
include
security_issue_1
expect
(
issues
).
not_to
include
security_issue_2
expect
(
issues
).
not_to
include
security_issue_3
expect
(
issues
).
not_to
include
security_issue_4
expect
(
issues
).
not_to
include
security_issue_5
expect
(
results
.
issues_count
).
to
eq
1
end
it
'should list confidential issues for author'
do
results
=
described_class
.
new
(
author
,
limit_projects
,
query
)
issues
=
results
.
objects
(
'issues'
)
expect
(
issues
).
to
include
issue
expect
(
issues
).
to
include
security_issue_1
expect
(
issues
).
not_to
include
security_issue_2
expect
(
issues
).
to
include
security_issue_3
expect
(
issues
).
not_to
include
security_issue_4
expect
(
issues
).
not_to
include
security_issue_5
expect
(
results
.
issues_count
).
to
eq
3
end
it
'should list confidential issues for project members'
do
project_1
.
team
<<
[
member
,
:developer
]
project_2
.
team
<<
[
member
,
:developer
]
results
=
described_class
.
new
(
member
,
limit_projects
,
query
)
issues
=
results
.
objects
(
'issues'
)
expect
(
issues
).
to
include
issue
expect
(
issues
).
to
include
security_issue_1
expect
(
issues
).
to
include
security_issue_2
expect
(
issues
).
to
include
security_issue_3
expect
(
issues
).
not_to
include
security_issue_4
expect
(
issues
).
not_to
include
security_issue_5
expect
(
results
.
issues_count
).
to
eq
4
end
it
'should list all issues for admin'
do
results
=
described_class
.
new
(
admin
,
limit_projects
,
query
)
issues
=
results
.
objects
(
'issues'
)
expect
(
issues
).
to
include
issue
expect
(
issues
).
to
include
security_issue_1
expect
(
issues
).
to
include
security_issue_2
expect
(
issues
).
to
include
security_issue_3
expect
(
issues
).
to
include
security_issue_4
expect
(
issues
).
not_to
include
security_issue_5
expect
(
results
.
issues_count
).
to
eq
5
end
end
end
end
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment