From db0cf709703f0cc344351d2a8fd28d7d51046296 Mon Sep 17 00:00:00 2001 From: Alexis Reigel Date: Mon, 17 Dec 2018 14:30:49 +0100 Subject: [PATCH] restrict user result set by the scoped group --- lib/gitlab/group_search_results.rb | 12 +++++++++--- spec/lib/gitlab/group_search_results_spec.rb | 10 ++++++++++ 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/lib/gitlab/group_search_results.rb b/lib/gitlab/group_search_results.rb index 8223135dc07..7255293b194 100644 --- a/lib/gitlab/group_search_results.rb +++ b/lib/gitlab/group_search_results.rb @@ -13,11 +13,17 @@ module Gitlab # 1: get all groups the current user has access to groups = GroupsFinder.new(current_user).execute.joins(:users) - # 2: get all users the current user has access to (-> `SearchResults#users`) + # 2: Get the group's whole hierarchy + group_users = @group.direct_and_indirect_users + + # 3: get all users the current user has access to (-> + # `SearchResults#users`), which also applies the query. users = super - # 3: filter for users that belong to the previously selected groups - users.where(id: groups.select('members.user_id')) + # 4: filter for users that belong to the previously selected groups + users + .where(id: group_users.select('id')) + .where(id: groups.select('members.user_id')) end # rubocop:enable CodeReuse/ActiveRecord end diff --git a/spec/lib/gitlab/group_search_results_spec.rb b/spec/lib/gitlab/group_search_results_spec.rb index 02245ca88dc..2734fcef0a0 100644 --- a/spec/lib/gitlab/group_search_results_spec.rb +++ b/spec/lib/gitlab/group_search_results_spec.rb @@ -55,5 +55,15 @@ describe Gitlab::GroupSearchResults do expect(result).to eq [] end + + it 'does not return the user belonging to an unrelated group' do + user = create(:user, username: 'gob_bluth') + unrelated_group = create(:group) + create(:group_member, :developer, user: user, group: unrelated_group) + + result = described_class.new(user, anything, group, 'gob').objects('users') + + expect(result).to eq [] + end end end