From 93349b4440add0da70f87026ae434be5c10f1ad1 Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Tue, 15 May 2018 22:34:29 +0900
Subject: [PATCH 1/4] Append trace only if the job is running

---
 lib/api/runner.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/api/runner.rb b/lib/api/runner.rb
index 649feba1036..a4df98cadac 100644
--- a/lib/api/runner.rb
+++ b/lib/api/runner.rb
@@ -165,7 +165,7 @@ module API
         body_start = content_range[0].to_i
         body_end = body_start + body_data.bytesize
 
-        stream_size = job.trace.append(body_data, body_start)
+        stream_size = job.trace.append(body_data, body_start)  if job.running?
         unless stream_size == body_end
           break error!('416 Range Not Satisfiable', 416, { 'Range' => "0-#{stream_size}" })
         end

From 5af5815d62f3430c52bb489c590eaa32402b18fa Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Fri, 18 May 2018 16:05:11 +0900
Subject: [PATCH 2/4] Add the same gurad clause with artifacts uplaoding

---
 lib/api/runner.rb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/lib/api/runner.rb b/lib/api/runner.rb
index a4df98cadac..a7f1cb1131f 100644
--- a/lib/api/runner.rb
+++ b/lib/api/runner.rb
@@ -149,6 +149,7 @@ module API
       end
       patch '/:id/trace' do
         job = authenticate_job!
+        forbidden!('Job is not running') unless job.running?
 
         error!('400 Missing header Content-Range', 400) unless request.headers.key?('Content-Range')
         content_range = request.headers['Content-Range']
@@ -165,7 +166,7 @@ module API
         body_start = content_range[0].to_i
         body_end = body_start + body_data.bytesize
 
-        stream_size = job.trace.append(body_data, body_start)  if job.running?
+        stream_size = job.trace.append(body_data, body_start)
         unless stream_size == body_end
           break error!('416 Range Not Satisfiable', 416, { 'Range' => "0-#{stream_size}" })
         end

From b053c483e792e00c50ba57e461e3a09ebdb8f34d Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Mon, 21 May 2018 21:11:00 +0900
Subject: [PATCH 3/4] Add test for the cancelled jobs

---
 spec/requests/api/runner_spec.rb | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/spec/requests/api/runner_spec.rb b/spec/requests/api/runner_spec.rb
index da392c5ab81..efb9bddde44 100644
--- a/spec/requests/api/runner_spec.rb
+++ b/spec/requests/api/runner_spec.rb
@@ -918,6 +918,22 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
             expect(job.reload.trace.raw).to eq 'BUILD TRACE appended appended'
           end
 
+          context 'when job is cancelled' do
+            before do
+              job.cancel
+            end
+
+            context 'when trace is patched' do
+              before do
+                patch_the_trace
+              end
+
+              it 'returns Forbidden ' do
+                expect(response.status).to eq(403)
+              end
+            end
+          end
+
           context 'when redis data are flushed' do
             before do
               redis_shared_state_cleanup!

From c94b607ae6150808a063fc6b2916bda0dc4850ab Mon Sep 17 00:00:00 2001
From: Shinya Maeda <shinya@gitlab.com>
Date: Mon, 21 May 2018 21:42:01 +0900
Subject: [PATCH 4/4] Add changelog

---
 .../unreleased/create-live-trace-only-if-job-is-complete.yml | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 changelogs/unreleased/create-live-trace-only-if-job-is-complete.yml

diff --git a/changelogs/unreleased/create-live-trace-only-if-job-is-complete.yml b/changelogs/unreleased/create-live-trace-only-if-job-is-complete.yml
new file mode 100644
index 00000000000..f32c70cf884
--- /dev/null
+++ b/changelogs/unreleased/create-live-trace-only-if-job-is-complete.yml
@@ -0,0 +1,5 @@
+---
+title: Forbid to patch traces for finished jobs
+merge_request: 18969
+author:
+type: fixed