BigW Consortium Gitlab
Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
G
gitlab-ce
Project
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
Registry
Registry
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Commits
Issue Boards
Open sidebar
Forest Godfrey
gitlab-ce
Commits
03dba1fd
Commit
03dba1fd
authored
Oct 16, 2013
by
Dmitriy Zaporozhets
Browse files
Options
Browse Files
Download
Plain Diff
Merge pull request #5344 from amacarthur/thread-variable-fix
Fixing unsafe use of Thread.current variable :current_user
parents
dad83166
aefe2e95
Show whitespace changes
Inline
Side-by-side
Showing
14 changed files
with
86 additions
and
10 deletions
+86
-10
application_controller.rb
app/controllers/application_controller.rb
+6
-1
09_issues.rb
db/fixtures/development/09_issues.rb
+5
-0
10_merge_requests.rb
db/fixtures/development/10_merge_requests.rb
+4
-0
env.rb
features/support/env.rb
+2
-0
helpers.rb
lib/api/helpers.rb
+9
-0
issues.rb
lib/api/issues.rb
+4
-1
merge_requests.rb
lib/api/merge_requests.rb
+6
-1
milestones.rb
lib/api/milestones.rb
+4
-0
notes.rb
lib/api/notes.rb
+4
-0
project_spec.rb
spec/models/project_spec.rb
+1
-7
issues_spec.rb
spec/requests/api/issues_spec.rb
+12
-0
milestones_spec.rb
spec/requests/api/milestones_spec.rb
+12
-0
notes_spec.rb
spec/requests/api/notes_spec.rb
+12
-0
test_env.rb
spec/support/test_env.rb
+5
-0
No files found.
app/controllers/application_controller.rb
View file @
03dba1fd
...
...
@@ -2,7 +2,7 @@ class ApplicationController < ActionController::Base
before_filter
:authenticate_user!
before_filter
:reject_blocked!
before_filter
:check_password_expiration
before
_filter
:set_current_user_for_thread
around
_filter
:set_current_user_for_thread
before_filter
:add_abilities
before_filter
:dev_tools
if
Rails
.
env
==
'development'
before_filter
:default_headers
...
...
@@ -50,6 +50,11 @@ class ApplicationController < ActionController::Base
def
set_current_user_for_thread
Thread
.
current
[
:current_user
]
=
current_user
begin
yield
ensure
Thread
.
current
[
:current_user
]
=
nil
end
end
def
abilities
...
...
db/fixtures/development/09_issues.rb
View file @
03dba1fd
...
...
@@ -11,6 +11,8 @@ Gitlab::Seeder.quiet do
next
unless
user
user_id
=
user
.
id
begin
Thread
.
current
[
:current_user
]
=
user
Issue
.
seed
(
:id
,
[{
...
...
@@ -22,6 +24,9 @@ Gitlab::Seeder.quiet do
milestone:
project
.
milestones
.
sample
,
title:
Faker
::
Lorem
.
sentence
(
6
)
}])
ensure
Thread
.
current
[
:current_user
]
=
nil
end
print
(
'.'
)
end
...
...
db/fixtures/development/10_merge_requests.rb
View file @
03dba1fd
...
...
@@ -17,6 +17,7 @@ Gitlab::Seeder.quiet do
next
if
branches
.
uniq
.
size
<
2
user_id
=
user
.
id
begin
Thread
.
current
[
:current_user
]
=
user
MergeRequest
.
seed
(
:id
,
[{
...
...
@@ -30,6 +31,9 @@ Gitlab::Seeder.quiet do
milestone:
project
.
milestones
.
sample
,
title:
Faker
::
Lorem
.
sentence
(
6
)
}])
ensure
Thread
.
current
[
:current_user
]
=
nil
end
print
(
'.'
)
end
end
...
...
features/support/env.rb
View file @
03dba1fd
...
...
@@ -51,4 +51,6 @@ Spinach.hooks.before_run do
RSpec
::
Mocks
::
setup
self
include
FactoryGirl
::
Syntax
::
Methods
MergeRequestObserver
.
any_instance
.
stub
(
current_user:
create
(
:user
))
end
lib/api/helpers.rb
View file @
03dba1fd
...
...
@@ -27,6 +27,15 @@ module API
end
end
def
set_current_user_for_thread
Thread
.
current
[
:current_user
]
=
current_user
begin
yield
ensure
Thread
.
current
[
:current_user
]
=
nil
end
end
def
user_project
@project
||=
find_project
(
params
[
:id
])
@project
||
not_found!
...
...
lib/api/issues.rb
View file @
03dba1fd
...
...
@@ -2,7 +2,6 @@ module API
# Issues API
class
Issues
<
Grape
::
API
before
{
authenticate!
}
before
{
Thread
.
current
[
:current_user
]
=
current_user
}
resource
:issues
do
# Get currently authenticated user's issues
...
...
@@ -49,6 +48,7 @@ module API
# Example Request:
# POST /projects/:id/issues
post
":id/issues"
do
set_current_user_for_thread
do
required_attributes!
[
:title
]
attrs
=
attributes_for_keys
[
:title
,
:description
,
:assignee_id
,
:milestone_id
]
attrs
[
:label_list
]
=
params
[
:labels
]
if
params
[
:labels
].
present?
...
...
@@ -60,6 +60,7 @@ module API
not_found!
end
end
end
# Update an existing issue
#
...
...
@@ -75,6 +76,7 @@ module API
# Example Request:
# PUT /projects/:id/issues/:issue_id
put
":id/issues/:issue_id"
do
set_current_user_for_thread
do
@issue
=
user_project
.
issues
.
find
(
params
[
:issue_id
])
authorize!
:modify_issue
,
@issue
...
...
@@ -87,6 +89,7 @@ module API
not_found!
end
end
end
# Delete a project issue (deprecated)
#
...
...
lib/api/merge_requests.rb
View file @
03dba1fd
...
...
@@ -2,7 +2,6 @@ module API
# MergeRequest API
class
MergeRequests
<
Grape
::
API
before
{
authenticate!
}
before
{
Thread
.
current
[
:current_user
]
=
current_user
}
resource
:projects
do
helpers
do
...
...
@@ -70,6 +69,7 @@ module API
# POST /projects/:id/merge_requests
#
post
":id/merge_requests"
do
set_current_user_for_thread
do
authorize!
:write_merge_request
,
user_project
required_attributes!
[
:source_branch
,
:target_branch
,
:title
]
attrs
=
attributes_for_keys
[
:source_branch
,
:target_branch
,
:assignee_id
,
:title
,
:target_project_id
]
...
...
@@ -94,6 +94,7 @@ module API
handle_merge_request_errors!
merge_request
.
errors
end
end
end
# Update MR
#
...
...
@@ -109,6 +110,7 @@ module API
# PUT /projects/:id/merge_request/:merge_request_id
#
put
":id/merge_request/:merge_request_id"
do
set_current_user_for_thread
do
attrs
=
attributes_for_keys
[
:source_branch
,
:target_branch
,
:assignee_id
,
:title
,
:state_event
]
merge_request
=
user_project
.
merge_requests
.
find
(
params
[
:merge_request_id
])
...
...
@@ -122,6 +124,7 @@ module API
handle_merge_request_errors!
merge_request
.
errors
end
end
end
# Post comment to merge request
#
...
...
@@ -133,6 +136,7 @@ module API
# POST /projects/:id/merge_request/:merge_request_id/comments
#
post
":id/merge_request/:merge_request_id/comments"
do
set_current_user_for_thread
do
required_attributes!
[
:note
]
merge_request
=
user_project
.
merge_requests
.
find
(
params
[
:merge_request_id
])
...
...
@@ -145,6 +149,7 @@ module API
not_found!
end
end
end
end
end
...
...
lib/api/milestones.rb
View file @
03dba1fd
...
...
@@ -40,6 +40,7 @@ module API
# Example Request:
# POST /projects/:id/milestones
post
":id/milestones"
do
set_current_user_for_thread
do
authorize!
:admin_milestone
,
user_project
required_attributes!
[
:title
]
...
...
@@ -51,6 +52,7 @@ module API
not_found!
end
end
end
# Update an existing project milestone
#
...
...
@@ -64,6 +66,7 @@ module API
# Example Request:
# PUT /projects/:id/milestones/:milestone_id
put
":id/milestones/:milestone_id"
do
set_current_user_for_thread
do
authorize!
:admin_milestone
,
user_project
@milestone
=
user_project
.
milestones
.
find
(
params
[
:milestone_id
])
...
...
@@ -76,4 +79,5 @@ module API
end
end
end
end
end
lib/api/notes.rb
View file @
03dba1fd
...
...
@@ -41,6 +41,7 @@ module API
# Example Request:
# POST /projects/:id/notes
post
":id/notes"
do
set_current_user_for_thread
do
required_attributes!
[
:body
]
@note
=
user_project
.
notes
.
new
(
note:
params
[
:body
])
...
...
@@ -54,6 +55,7 @@ module API
not_found!
end
end
end
NOTEABLE_TYPES
.
each
do
|
noteable_type
|
noteables_str
=
noteable_type
.
to_s
.
underscore
.
pluralize
...
...
@@ -97,6 +99,7 @@ module API
# POST /projects/:id/issues/:noteable_id/notes
# POST /projects/:id/snippets/:noteable_id/notes
post
":id/
#{
noteables_str
}
/:
#{
noteable_id_str
}
/notes"
do
set_current_user_for_thread
do
required_attributes!
[
:body
]
@noteable
=
user_project
.
send
(
:"
#{
noteables_str
}
"
).
find
(
params
[
:"
#{
noteable_id_str
}
"
])
...
...
@@ -113,4 +116,5 @@ module API
end
end
end
end
end
spec/models/project_spec.rb
View file @
03dba1fd
...
...
@@ -27,13 +27,7 @@
require
'spec_helper'
describe
Project
do
let
(
:user
)
{
create
(
:user
)
}
before
do
enable_observers
Thread
.
current
[
:current_user
]
=
user
end
before
{
enable_observers
}
after
{
disable_observers
}
describe
"Associations"
do
...
...
spec/requests/api/issues_spec.rb
View file @
03dba1fd
...
...
@@ -100,4 +100,16 @@ describe API::API do
response
.
status
.
should
==
405
end
end
describe
"PUT /projects/:id/issues/:issue_id to test observer on close"
do
before
{
enable_observers
}
after
{
disable_observers
}
it
"should create an activity event when an issue is closed"
do
Event
.
should_receive
(
:create
)
put
api
(
"/projects/
#{
project
.
id
}
/issues/
#{
issue
.
id
}
"
,
user
),
state_event:
"close"
end
end
end
spec/requests/api/milestones_spec.rb
View file @
03dba1fd
...
...
@@ -90,4 +90,16 @@ describe API::API do
json_response
[
'state'
].
should
==
'closed'
end
end
describe
"PUT /projects/:id/milestones/:milestone_id to test observer on close"
do
before
{
enable_observers
}
after
{
disable_observers
}
it
"should create an activity event when an milestone is closed"
do
Event
.
should_receive
(
:create
)
put
api
(
"/projects/
#{
project
.
id
}
/milestones/
#{
milestone
.
id
}
"
,
user
),
state_event:
'close'
end
end
end
spec/requests/api/notes_spec.rb
View file @
03dba1fd
...
...
@@ -176,4 +176,16 @@ describe API::API do
end
end
end
describe
"POST /projects/:id/noteable/:noteable_id/notes to test observer on create"
do
before
{
enable_observers
}
after
{
disable_observers
}
it
"should create an activity event when an issue note is created"
do
Event
.
should_receive
(
:create
)
post
api
(
"/projects/
#{
project
.
id
}
/issues/
#{
issue
.
id
}
/notes"
,
user
),
body:
'hi!'
end
end
end
spec/support/test_env.rb
View file @
03dba1fd
...
...
@@ -84,6 +84,11 @@ module TestEnv
Repository
.
any_instance
.
stub
(
size:
12.45
)
ActivityObserver
.
any_instance
.
stub
(
current_user:
double
(
"current_user"
,
id:
1
)
)
end
def
clear_repo_dir
(
namespace
,
name
)
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment