Merge branch 'fix/import-permissions' into 'master'

Set permissions to admin for importing a project via Import/Export

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/20802

In order to import a project, it is now required to be an admin

Moved from https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5766

See merge request !1983
(cherry picked from commit 966b3038)

CHANGELOG

@@ -3,6 +3,7 @@ Please view this file on the master branch, on stable branches it's out of date.
 v 8.10.6
   - Upgrade Rails to 4.2.7.1 for security fixes. !5781
   - Fix privilege escalation via project export.
+  - Require administrator privileges to perform a project import.
 
 v 8.10.5
   - Add a data migration to fix some missing timestamps in the members table. !5670

app/controllers/import/gitlab_projects_controller.rb

 class Import::GitlabProjectsController < Import::BaseController
   before_action :verify_gitlab_project_import_enabled
+  before_action :authenticate_admin!
 
   def new
     @namespace_id = project_params[:namespace_id]
@@ -47,4 +48,8 @@ class Import::GitlabProjectsController < Import::BaseController
       :path, :namespace_id, :file
     )
   end
+
+  def authenticate_admin!
+    render_404 unless current_user.is_admin?
+  end
 end

app/views/projects/new.html.haml

@@ -90,7 +90,7 @@
                       %i.fa.fa-git
                       %span Repo by URL
                 %div{ class: 'import_gitlab_project' }
-                  - if gitlab_project_import_enabled?
+                  - if gitlab_project_import_enabled? && current_user.is_admin?
                     = link_to new_import_gitlab_project_path, class: 'btn btn_import_gitlab_project project-submit' do
                       %i.fa.fa-gitlab
                       %span GitLab export

doc/user/project/settings/import_export.md

@@ -6,8 +6,7 @@
     than that of the exporter.
   - For existing installations, the project import option has to be enabled in
     application settings (`/admin/application_settings`) under 'Import sources'.
-    Ask your administrator if you don't see the **GitLab export** button when
-    creating a new project.
+    You will have to be an administrator to enable and use the import functionality.
   - You can find some useful raketasks if you are an administrator in the
     [import_export](../../../administration/raketasks/project_import_export.md)
     raketask.

features/dashboard/new_project.feature

@@ -9,7 +9,7 @@ Background:
   @javascript
   Scenario: I should see New Projects page
   Then I see "New Project" page
-  Then I see all possible import optios
+  Then I see all possible import options
 
   @javascript
   Scenario: I should see instructions on how to import from Git URL

features/steps/dashboard/new_project.rb

@@ -14,14 +14,13 @@ class Spinach::Features::NewProject < Spinach::FeatureSteps
     expect(page).to have_content('Project name')
   end
 
-  step 'I see all possible import optios' do
+  step 'I see all possible import options' do
     expect(page).to have_link('GitHub')
     expect(page).to have_link('Bitbucket')
     expect(page).to have_link('GitLab.com')
     expect(page).to have_link('Gitorious.org')
     expect(page).to have_link('Google Code')
     expect(page).to have_link('Repo by URL')
-    expect(page).to have_link('GitLab export')
   end
 
   step 'I click on "Import project from GitHub"' do

spec/features/projects/import_export/import_file_spec.rb

@@ -3,8 +3,9 @@ require 'spec_helper'
 feature 'project import', feature: true, js: true do
   include Select2Helper
 
-  let(:user) { create(:admin) }
-  let!(:namespace) { create(:namespace, name: "asd", owner: user) }
+  let(:admin) { create(:admin) }
+  let(:normal_user) { create(:user) }
+  let!(:namespace) { create(:namespace, name: "asd", owner: admin) }
   let(:file) { File.join(Rails.root, 'spec', 'features', 'projects', 'import_export', 'test_project_export.tar.gz') }
   let(:export_path) { "#{Dir::tmpdir}/import_file_spec" }
   let(:project) { Project.last }
@@ -12,13 +13,17 @@ feature 'project import', feature: true, js: true do
 
   background do
     allow_any_instance_of(Gitlab::ImportExport).to receive(:storage_path).and_return(export_path)
-    login_as(user)
   end
 
   after(:each) do
     FileUtils.rm_rf(export_path, secure: true)
   end
 
+  context 'admin user' do
+    before do
+      login_as(admin)
+    end
+
     scenario 'user imports an exported project successfully' do
       expect(Project.all.count).to be_zero
 
@@ -74,6 +79,23 @@ feature 'project import', feature: true, js: true do
         expect(page).to have_content('Please enter path and name')
       end
     end
+  end
+
+  context 'normal user' do
+    before do
+      login_as(normal_user)
+    end
+
+    scenario 'non-admin user is not allowed to import a project' do
+      expect(Project.all.count).to be_zero
+
+      visit new_project_path
+
+      fill_in :project_path, with: 'test-project-path', visible: true
+
+      expect(page).not_to have_content('GitLab export')
+    end
+  end
 
   def wiki_exists?
     wiki = ProjectWiki.new(project)