From cabc131cfbee72e3a1eaae94619dcf1e3cc59d5a Mon Sep 17 00:00:00 2001 From: Phil Hughes Date: Tue, 25 Oct 2016 12:57:56 +0100 Subject: [PATCH] Stop unauthized users dragging on issue boards Closes #23763 --- CHANGELOG.md | 3 ++- app/helpers/boards_helper.rb | 2 +- spec/features/boards/boards_spec.rb | 4 ++++ 3 files changed, 7 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 21f2bec867f..a8603170355 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,7 +23,8 @@ Please view this file on the master branch, on stable branches it's out of date. - Fixed hidden pipeline graph on commit and MR page !6895 - Expire and build repository cache after project import - Fix 404 for group pages when GitLab setup uses relative url - - Simpler arguments passed to named_route on toggle_award_url helper method + - Simpler arguments passed to named_route on toggle_award_url helper method + - Fix unauthorized users dragging on issue boards - Better handle when no users were selected for adding to group or project. (Linus Thiel) - Only show register tab if signup enabled. diff --git a/app/helpers/boards_helper.rb b/app/helpers/boards_helper.rb index b7247ffa8b2..38c586ccd31 100644 --- a/app/helpers/boards_helper.rb +++ b/app/helpers/boards_helper.rb @@ -5,7 +5,7 @@ module BoardsHelper { endpoint: namespace_project_boards_path(@project.namespace, @project), board_id: board.id, - disabled: !can?(current_user, :admin_list, @project), + disabled: "#{!can?(current_user, :admin_list, @project)}", issue_link_base: namespace_project_issues_path(@project.namespace, @project) } end diff --git a/spec/features/boards/boards_spec.rb b/spec/features/boards/boards_spec.rb index 0fb1608a0a3..c533ce1d87f 100644 --- a/spec/features/boards/boards_spec.rb +++ b/spec/features/boards/boards_spec.rb @@ -624,6 +624,10 @@ describe 'Issue Boards', feature: true, js: true do it 'does not show create new list' do expect(page).not_to have_selector('.js-new-board-list') end + + it 'does not allow dragging' do + expect(page).not_to have_selector('.user-can-drag') + end end context 'as guest user' do