kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Respond with 403 when non-member requests for private MRs

Browse source
This commit is contained in:
Patrick Bajao 2019-01-25 15:44:50 +08:00
parent 35d4344edf
commit 276147c1f6
2 changed files with 15 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/api/commits.rb
View file

@ -318,6 +318,8 @@ module API
use :pagination
end
get ':id/repository/commits/:sha/merge_requests', requirements: API::COMMIT_ENDPOINT_REQUIREMENTS do
authorize! :read_merge_request, user_project
commit = user_project.commit(params[:sha])
not_found! 'Commit' unless commit

15
spec/requests/api/commits_spec.rb
View file

@ -1430,8 +1430,8 @@ describe API::Commits do
end
describe 'GET /projects/:id/repository/commits/:sha/merge_requests' do
let!(:project) { create(:project, :repository, :private) }
let!(:merged_mr) { create(:merge_request, source_project: project, source_branch: 'master', target_branch: 'feature') }
let(:project) { create(:project, :repository, :private) }
let(:merged_mr) { create(:merge_request, source_project: project, source_branch: 'master', target_branch: 'feature') }
let(:commit) { merged_mr.merge_request_diff.commits.last }
it 'returns the correct merge request' do
@ -1456,5 +1456,16 @@ describe API::Commits do
expect(response).to have_gitlab_http_status(404)
end
context 'public project' do
let(:project) { create(:project, :repository, :public, :merge_requests_private) }
let(:non_member) { create(:user) }
it 'responds 403 when only members are allowed to read merge requests' do
get api("/projects/#{project.id}/repository/commits/#{commit.id}/merge_requests", non_member)
expect(response).to have_gitlab_http_status(403)
end
end
end
end