Resolve possible cherry pick API race condition

Previously, we just fetched the latest commit for the given branch when
presenting the resulting commit, but because something could have been
committed to that branch between the time we cherry-picked and the time
we render the result, the wrong commit could have been presented.

Now, we fetch the commit object with the commit SHA returned by the
commit change service, which should always be the correct commit.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/53773
This commit is contained in:
Robert Speicher 2018-11-09 16:34:17 +00:00
parent 57cee17673
commit 11dd9d6e1f
No known key found for this signature in database
GPG key ID: 1D812769A7706642
2 changed files with 10 additions and 3 deletions

View file

@ -0,0 +1,5 @@
---
title: Resolve possible cherry pick API race condition
merge_request:
author:
type: fixed

View file

@ -194,11 +194,13 @@ module API
branch_name: params[:branch] branch_name: params[:branch]
} }
result = ::Commits::CherryPickService.new(user_project, current_user, commit_params).execute result = ::Commits::CherryPickService
.new(user_project, current_user, commit_params)
.execute
if result[:status] == :success if result[:status] == :success
branch = find_branch!(params[:branch]) present user_project.repository.commit(result[:result]),
present user_project.repository.commit(branch.dereferenced_target), with: Entities::Commit with: Entities::Commit
else else
render_api_error!(result[:message], 400) render_api_error!(result[:message], 400)
end end