Commit bc1b4d9f authored by Felipe Artur Cardozo's avatar Felipe Artur Cardozo

Merge branch 'security-fj-missing-csrf-system-hooks' into 'master'

[master] Missing CSRF in System Hooks

See merge request gitlab/gitlabhq!2419
parents e1d86b75 2408519e
......@@ -10,7 +10,7 @@ module HooksHelper
trigger_human_name = trigger.to_s.tr('_', ' ').camelize
link_to path, rel: 'nofollow' do
link_to path, rel: 'nofollow', method: :post do
content_tag(:span, trigger_human_name)
end
end
......
---
title: Adding CSRF protection to Hooks test action
merge_request:
author:
type: security
......@@ -54,7 +54,7 @@ namespace :admin do
resources :hooks, only: [:index, :create, :edit, :update, :destroy] do
member do
get :test
post :test
end
resources :hook_logs, only: [:show] do
......
......@@ -301,7 +301,7 @@ constraints(::Constraints::ProjectUrlConstrainer.new) do
resources :hooks, only: [:index, :create, :edit, :update, :destroy], constraints: { id: /\d+/ } do
member do
get :test
post :test
end
resources :hook_logs, only: [:show] do
......
......@@ -79,7 +79,7 @@ end
# edit_admin_hook GET /admin/hooks/:id(.:format) admin/hooks#edit
describe Admin::HooksController, "routing" do
it "to #test" do
expect(get("/admin/hooks/1/test")).to route_to('admin/hooks#test', id: '1')
expect(post("/admin/hooks/1/test")).to route_to('admin/hooks#test', id: '1')
end
it "to #index" do
......
......@@ -389,7 +389,7 @@ describe 'project routing' do
# DELETE /:project_id/hooks/:id(.:format) hooks#destroy
describe Projects::HooksController, 'routing' do
it 'to #test' do
expect(get('/gitlab/gitlabhq/hooks/1/test')).to route_to('projects/hooks#test', namespace_id: 'gitlab', project_id: 'gitlabhq', id: '1')
expect(post('/gitlab/gitlabhq/hooks/1/test')).to route_to('projects/hooks#test', namespace_id: 'gitlab', project_id: 'gitlabhq', id: '1')
end
it_behaves_like 'RESTful project resources' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment