Merge branch 'security-updating-description-of-trigger-by-other-maintainer' into 'master'

Prevent updating trigger by other maintainers

See merge request gitlab-org/security/gitlab!269

changelogs/unreleased/security-updating-description-of-trigger-by-other-maintainer.yml

+---
+title: Prevent updating trigger by other maintainers
+merge_request:
+author:
+type: security

lib/api/triggers.rb

@@ -109,6 +109,8 @@ module API
         trigger = user_project.triggers.find(params.delete(:trigger_id))
         break not_found!('Trigger') unless trigger
 
+        authorize! :admin_trigger, trigger
+
         if trigger.update(declared_params(include_missing: false))
           present trigger, with: Entities::Trigger, current_user: current_user
         else

spec/requests/api/triggers_spec.rb

@@ -238,24 +238,44 @@ describe API::Triggers do
   end
 
   describe 'PUT /projects/:id/triggers/:trigger_id' do
-    context 'authenticated user with valid permissions' do
-      let(:new_description) { 'new description' }
+    context 'user is maintainer of the project' do
+      context 'the trigger belongs to user' do
+        let(:new_description) { 'new description' }
 
-      it 'updates description' do
-        put api("/projects/#{project.id}/triggers/#{trigger.id}", user),
-          params: { description: new_description }
+        it 'updates description' do
+          put api("/projects/#{project.id}/triggers/#{trigger.id}", user),
+            params: { description: new_description }
 
-        expect(response).to have_gitlab_http_status(:ok)
-        expect(json_response).to include('description' => new_description)
-        expect(trigger.reload.description).to eq(new_description)
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response).to include('description' => new_description)
+          expect(trigger.reload.description).to eq(new_description)
+        end
+      end
+
+      context 'the trigger does not belong to user' do
+        it 'does not update trigger' do
+          put api("/projects/#{project.id}/triggers/#{trigger2.id}", user)
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
       end
     end
 
-    context 'authenticated user with invalid permissions' do
-      it 'does not update trigger' do
-        put api("/projects/#{project.id}/triggers/#{trigger.id}", user2)
+    context 'user is developer of the project' do
+      context 'the trigger belongs to user' do
+        it 'does not update trigger' do
+          put api("/projects/#{project.id}/triggers/#{trigger2.id}", user2)
 
-        expect(response).to have_gitlab_http_status(:forbidden)
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
+      end
+
+      context 'the trigger does not belong to user' do
+        it 'does not update trigger' do
+          put api("/projects/#{project.id}/triggers/#{trigger.id}", user2)
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
       end
     end