BigW Consortium Gitlab
Skip to content
Projects
Groups
Snippets
Help
This project
Loading...
Sign in / Register
Toggle navigation
G
gitlab-ce
Project
Overview
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
Registry
Registry
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Commits
Issue Boards
Open sidebar
Forest Godfrey
gitlab-ce
Commits
664ee814
Commit
664ee814
authored
May 07, 2017
by
Robert Speicher
Committed by
Timothy Andrew
May 31, 2017
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Merge branch 'dz-restrict-autocomplete' into 'security-9-1'
Allow users autocomplete by author_id only for authenticated users See merge request !2100
parent
6a9efdc5
Hide whitespace changes
Inline
Side-by-side
Showing
3 changed files
with
25 additions
and
11 deletions
+25
-11
autocomplete_controller.rb
app/controllers/autocomplete_controller.rb
+1
-1
dz-restrict-autocomplete.yml
changelogs/unreleased/dz-restrict-autocomplete.yml
+4
-0
autocomplete_controller_spec.rb
spec/controllers/autocomplete_controller_spec.rb
+20
-10
No files found.
app/controllers/autocomplete_controller.rb
View file @
664ee814
...
@@ -21,7 +21,7 @@ class AutocompleteController < ApplicationController
...
@@ -21,7 +21,7 @@ class AutocompleteController < ApplicationController
@users
=
[
current_user
,
*
@users
].
uniq
@users
=
[
current_user
,
*
@users
].
uniq
end
end
if
params
[
:author_id
].
present?
if
params
[
:author_id
].
present?
&&
current_user
author
=
User
.
find_by_id
(
params
[
:author_id
])
author
=
User
.
find_by_id
(
params
[
:author_id
])
@users
=
[
author
,
*
@users
].
uniq
if
author
@users
=
[
author
,
*
@users
].
uniq
if
author
end
end
...
...
changelogs/unreleased/dz-restrict-autocomplete.yml
0 → 100644
View file @
664ee814
---
title
:
Allow users autocomplete by author_id only for authenticated users
merge_request
:
author
:
spec/controllers/autocomplete_controller_spec.rb
View file @
664ee814
...
@@ -156,22 +156,32 @@ describe AutocompleteController do
...
@@ -156,22 +156,32 @@ describe AutocompleteController do
end
end
context
'author of issuable included'
do
context
'author of issuable included'
do
before
do
sign_in
(
user
)
end
let
(
:body
)
{
JSON
.
parse
(
response
.
body
)
}
let
(
:body
)
{
JSON
.
parse
(
response
.
body
)
}
it
'includes the author'
do
context
'authenticated'
do
get
(
:users
,
author_id:
non_member
.
id
)
before
do
sign_in
(
user
)
end
it
'includes the author'
do
get
(
:users
,
author_id:
non_member
.
id
)
expect
(
body
.
first
[
"username"
]).
to
eq
non_member
.
username
end
it
'rejects non existent user ids'
do
get
(
:users
,
author_id:
99999
)
expect
(
body
.
first
[
"username"
]).
to
eq
non_member
.
username
expect
(
body
.
collect
{
|
u
|
u
[
'id'
]
}).
not_to
include
(
99999
)
end
end
end
it
'rejects non existent user ids'
do
context
'without authenticating'
do
get
(
:users
,
author_id:
99999
)
it
'returns empty result'
do
get
(
:users
,
author_id:
non_member
.
id
)
expect
(
body
.
collect
{
|
u
|
u
[
'id'
]
}).
not_to
include
(
99999
)
expect
(
body
).
to
be_empty
end
end
end
end
end
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment