kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Fix group projects fetch

Browse source 
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
This commit is contained in:
Dmitriy Zaporozhets 2014-05-29 22:03:42 +03:00
parent 8f259c5ecc
commit f329d34ff3
No known key found for this signature in database
GPG key ID: 627C5F589F467F17
2 changed files with 15 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
app/controllers/groups_controller.rb
View file

@ -5,7 +5,7 @@ class GroupsController < ApplicationController
# Authorize
before_filter :authorize_read_group!, except: [:new, :create]
before_filter :authorize_admin_group!, only: [:edit, :update, :destroy]
before_filter :authorize_admin_group!, only: [:edit, :update, :destroy, :projects]
before_filter :authorize_create_group!, only: [:new, :create]
# Load group projects
@ -108,12 +108,12 @@ class GroupsController < ApplicationController
end
def project_ids
projects.pluck(:id)
@projects.pluck(:id)
end
# Dont allow unauthorized access to group
def authorize_read_group!
unless @group and (projects.present? or can?(current_user, :read_group, @group))
unless @group and (@projects.present? or can?(current_user, :read_group, @group))
if current_user.nil?
return authenticate_user!
else

12
spec/features/security/group/group_access_spec.rb
View file

@ -82,5 +82,17 @@ describe "Group access", feature: true do
it { should be_denied_for :user }
it { should be_denied_for :visitor }
end
describe "GET /groups/:path/projects" do
subject { projects_group_path(group) }
it { should be_allowed_for owner }
it { should be_denied_for master }
it { should be_denied_for reporter }
it { should be_allowed_for :admin }
it { should be_denied_for guest }
it { should be_denied_for :user }
it { should be_denied_for :visitor }
end
end
end