Commit c82a642b authored by Lin Jen-Shin's avatar Lin Jen-Shin

Protect manual actions against protected tag too

parent 5f32bd77
...@@ -3,9 +3,10 @@ module Ci ...@@ -3,9 +3,10 @@ module Ci
condition(:protected_action) do condition(:protected_action) do
next false unless @subject.action? next false unless @subject.action?
!::Gitlab::UserAccess access = ::Gitlab::UserAccess.new(@user, project: @subject.project)
.new(@user, project: @subject.project)
.can_merge_to_branch?(@subject.ref) !access.can_merge_to_branch?(@subject.ref) ||
!access.can_create_tag?(@subject.ref)
end end
rule { protected_action }.prevent :update_build rule { protected_action }.prevent :update_build
......
...@@ -103,12 +103,7 @@ describe Ci::BuildPolicy, :models do ...@@ -103,12 +103,7 @@ describe Ci::BuildPolicy, :models do
project.add_developer(user) project.add_developer(user)
end end
context 'when branch build is assigned to is protected' do shared_examples 'protected ref' do
before do
create(:protected_branch, :no_one_can_push,
name: 'some-ref', project: project)
end
context 'when build is a manual action' do context 'when build is a manual action' do
let(:build) do let(:build) do
create(:ci_build, :manual, ref: 'some-ref', pipeline: pipeline) create(:ci_build, :manual, ref: 'some-ref', pipeline: pipeline)
...@@ -130,6 +125,24 @@ describe Ci::BuildPolicy, :models do ...@@ -130,6 +125,24 @@ describe Ci::BuildPolicy, :models do
end end
end end
context 'when build is against a protected branch' do
before do
create(:protected_branch, :no_one_can_push,
name: 'some-ref', project: project)
end
it_behaves_like 'protected ref'
end
context 'when build is against a protected tag' do
before do
create(:protected_tag, :no_one_can_create,
name: 'some-ref', project: project)
end
it_behaves_like 'protected ref'
end
context 'when branch build is assigned to is not protected' do context 'when branch build is assigned to is not protected' do
context 'when build is a manual action' do context 'when build is a manual action' do
let(:build) { create(:ci_build, :manual, pipeline: pipeline) } let(:build) { create(:ci_build, :manual, pipeline: pipeline) }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment