ES: Notes exposure

CHANGELOG-EE

@@ -8,6 +8,9 @@ v 8.6.0 (unreleased)
   - [Elastic] Update index on push to wiki
   - [Elastic] Use subprocesses for ElasticSearch index jobs
 
+v 8.5.4
+  - [Elastic][Security] Notes exposure
+
 v 8.5.3
   - Prevent LDAP from downgrading a group's last owner
   - Update gitlab-elastic-search gem to 0.0.11

lib/elastic/issues_search.rb

@@ -40,7 +40,7 @@ module Elastic
         
         query_hash = basic_query_hash(options[:in], query)
 
-        query_hash = project_ids_filter(query_hash, options[:projects_ids])
+        query_hash = project_ids_filter(query_hash, options[:project_ids])
 
         self.__elasticsearch__.search(query_hash)
       end

lib/elastic/merge_requests_search.rb

@@ -61,12 +61,12 @@ module Elastic
       def self.elastic_search(query, options: {})
         query_hash = basic_query_hash(%w(title^2 description), query)
 
-        if options[:projects_ids]
+        if options[:project_ids]
           query_hash[:query][:filtered][:filter] = {
             and: [
               {
                 terms: {
-                  target_project_id: [options[:projects_ids]].flatten
+                  target_project_id: [options[:project_ids]].flatten
                 }
               }
             ]

lib/elastic/milestones_search.rb

@@ -28,7 +28,7 @@ module Elastic
 
         query_hash = basic_query_hash(options[:in], query)
 
-        query_hash = project_ids_filter(query_hash, options[:projects_ids])
+        query_hash = project_ids_filter(query_hash, options[:project_ids])
 
         self.__elasticsearch__.search(query_hash)
       end

lib/elastic/notes_search.rb

@@ -37,7 +37,7 @@ module Elastic
           query_hash[:track_scores] = true
         end
 
-        query_hash = project_ids_filter(query_hash, options[:projects_ids])
+        query_hash = project_ids_filter(query_hash, options[:project_ids])
 
         query_hash[:sort] = [
           { updated_at_sort: { order: :desc, mode: :min } },

lib/gitlab/elastic/search_results.rb

@@ -63,7 +63,7 @@ module Gitlab
 
       def issues
         opt = {
-          projects_ids: limit_project_ids
+          project_ids: limit_project_ids
         }
 
         if query =~ /#(\d+)\z/
@@ -75,7 +75,7 @@ module Gitlab
 
       def milestones
         opt = {
-          projects_ids: limit_project_ids
+          project_ids: limit_project_ids
         }
 
         Milestone.elastic_search(query, options: opt)
@@ -83,7 +83,7 @@ module Gitlab
 
       def merge_requests
         opt = {
-          projects_ids: limit_project_ids
+          project_ids: limit_project_ids
         }
 
         if query =~ /[#!](\d+)\z/

spec/lib/elastic/issue_spec.rb

@@ -23,7 +23,7 @@ describe "Issue", elastic: true do
 
     Issue.__elasticsearch__.refresh_index!
 
-    options = { projects_ids: [project.id] }
+    options = { project_ids: [project.id] }
 
     expect(Issue.elastic_search('term', options: options).total_count).to eq(2)
   end

spec/lib/elastic/merge_request_spec.rb

@@ -23,7 +23,7 @@ describe "MergeRequest", elastic: true do
 
     MergeRequest.__elasticsearch__.refresh_index!
 
-    options = { projects_ids: [project.id] }
+    options = { project_ids: [project.id] }
 
     expect(MergeRequest.elastic_search('term', options: options).total_count).to eq(2)
   end

spec/lib/elastic/milestone_spec.rb

@@ -18,11 +18,12 @@ describe "Milestone", elastic: true do
     create :milestone, description: 'bla-bla term', project: project
     create :milestone, project: project
 
+    # The milestone you have no access to
     create :milestone, title: 'bla-bla term'
 
     Milestone.__elasticsearch__.refresh_index!
 
-    options = { projects_ids: [project.id] }
+    options = { project_ids: [project.id] }
 
     expect(Milestone.elastic_search('term', options: options).total_count).to eq(2)
   end

spec/lib/elastic/note_spec.rb

@@ -22,7 +22,7 @@ describe "Note", elastic: true do
 
     Note.__elasticsearch__.refresh_index!
 
-    options = { projects_ids: [issue.project.id] }
+    options = { project_ids: [issue.project.id] }
 
     expect(Note.elastic_search('term', options: options).total_count).to eq(1)
   end

spec/lib/gitlab/elastic/project_search_results_spec.rb

@@ -31,4 +31,35 @@ describe Gitlab::Elastic::ProjectSearchResults, lib: true do
     it { expect(results.repository_ref).to eq(ref) }
     it { expect(results.query).to eq('hello world') }
   end
+
+  describe "search" do
+    it "returns correct amounts" do
+      project = create :project
+      project1 = create :project
+
+      project.repository.index_blobs
+      project.repository.index_commits
+      
+      # Notes
+      create :note, note: 'bla-bla term', project: project
+      # The note in the project you have no access to
+      create :note, note: 'bla-bla term', project: project1
+
+      # Wiki
+      project.wiki.create_page("index_page", "term")
+      project.wiki.index_blobs
+      project1.wiki.create_page("index_page", " term")
+      project1.wiki.index_blobs
+
+      Project.__elasticsearch__.refresh_index!
+
+      result = Gitlab::Elastic::ProjectSearchResults.new(project.id, "term")
+      expect(result.notes_count).to eq(1)
+      expect(result.wiki_blobs_count).to eq(1)
+      expect(result.blobs_count).to eq(1)
+
+      result1 = Gitlab::Elastic::ProjectSearchResults.new(project.id, "initial")
+      expect(result1.commits_count).to eq(1)
+    end
+  end
 end