Commit graph

18 commits

Author SHA1 Message Date
Jan Provaznik
741caf93e1 Use limited count queries also for scoped searches 2018-03-05 13:25:56 +00:00
Jarka Kadlecová
7381944565 Support search in API 2018-02-06 16:02:02 +01:00
Jan Provaznik
090ca9c33e Use limit for search count queries
Search query is especially slow if a user searches a generic string
which matches many records, in such case search can take tens of
seconds or time out. To speed up the search query, we search only for
first 1000 records, if there is >1000 matching records we just display
"1000+" instead of precise total count supposing that with such amount
the exact count is not so important for the user.

Because for issues even limited search was not fast enough, 2-phase
approach is used for issues: first we use simpler/faster query to get
all public issues, if this exceeds the limit, we just return the limit.
If the amount of matching results is lower than limit, we re-run more
complex search query (which includes also confidential issues).
Re-running the complex query should be fast enough in such case because the
amount of matching issues is lower than limit.

Because exact total_count is now limited, this patch also switches to
to "prev/next" pagination.

Related #40540
2018-01-23 22:33:42 +01:00
Sean McGivern
5e3103678b Merge branch 'jprovazn-search-issues' into 'master'
Skip projects filter on issues search

See merge request gitlab-org/gitlab-ce!16117
2018-01-03 09:21:09 +00:00
Jan Provaznik
017c1297cd Skip projects filter on issues search
When searching for issues, an additional subquery
is added which filters only issues in a project. If global context is
used (no project is specified) this query filters all projects user has
access to.

In that case we can skip this filter because filtering only projects
user has access to is added anyway.

The filter is used only if a custom project context is specified

Related to #40540
2018-01-02 12:07:26 +01:00
blackst0ne
27c95364b5 Replace '.team << [user, role]' with 'add_role(user)' in specs 2017-12-22 19:18:28 +11:00
Jan Provaznik
d2f1d585e1 Skip projects filter on merge requests search
When searching for merge requests, an additional subquery
is added which by default filters only merge requests which belong
to source or target project user has permission for.

This filter is not needed because more restrictive filter
which checks if user has permission for target project
is used in the query.

So unless a custom projects filter is used by user, it's possible
to skip the default projects filter and speed up the final query.

Related to #40540
2017-12-21 15:43:14 +01:00
Bob Van Landuyt
e8ca579d88 Add a project forks spec helper
The helper creates a fork of a project with all provided attributes,
but skipping the creation of the repository on disk.
2017-10-07 11:46:23 +02:00
Robert Speicher
72a7b30c9f Change all :empty_project to :project 2017-08-02 17:47:31 -04:00
Valery Sizov
387c4b2c21 Backport of multiple_assignees_feature [ci skip] 2017-05-04 17:11:53 +03:00
Robert Speicher
80a6d2fda2 Use :empty_project where possible throughout spec/lib 2017-01-25 12:25:42 -05:00
Douwe Maan
f23b1cb453 Merge branch 'jej-23867-use-mr-finder-instead-of-access-check' into 'security'
Replace MR access checks with use of MergeRequestsFinder

Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867

⚠️ - Potentially untested
💣 - No test coverage
🚥 - Test coverage of some sort exists (a test failed when error raised)
🚦 - Test coverage of return value (a test failed when nil used)
 - Permissions check tested

- [x] 💣  app/finders/notes_finder.rb:17
- [x] ⚠️  app/views/layouts/nav/_project.html.haml:80 [`.count`]
- [x] 💣  app/controllers/concerns/creates_commit.rb:84
- [x] 🚥  app/controllers/projects/commits_controller.rb:24
- [x] 🚥  app/controllers/projects/compare_controller.rb:56
- [x] 🚦  app/controllers/projects/discussions_controller.rb:29
- [x]   app/controllers/projects/todos_controller.rb:27
- [x] 🚦  app/models/commit.rb:268
- [x]  lib/gitlab/search_results.rb:71

- [x] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#d1c10892daedb4d4dd3d4b12b6d071091eea83df_267_266 Memoize ` merged_merge_request(current_user)`
- [x] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#d1c10892daedb4d4dd3d4b12b6d071091eea83df_248_247 Expected side effect for `merged_merge_request!`, consider `skip_authorization: true`.
- [x] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#d1c10892daedb4d4dd3d4b12b6d071091eea83df_269_269 Scary use  of unchecked `merged_merge_request?`

See merge request !2033
2016-12-08 21:42:07 -03:00
Douwe Maan
3bf34face4 Merge branch 'jej-use-issuable-finder-instead-of-access-check' into 'security'
Replace issue access checks with use of IssuableFinder

Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867

## Which fixes are in this MR?

⚠️ - Potentially untested  
💣 - No test coverage  
🚥 - Test coverage of some sort exists (a test failed when error raised)  
🚦 - Test coverage of return value (a test failed when nil used)  
 - Permissions check tested

### Issue lookup with access check

Using `visible_to_user` likely makes these security issues too. See [Code smells](#code-smells).

- [x] 🚦 app/finders/notes_finder.rb:15 [`visible_to_user`]
- [x] 🚥 app/views/layouts/nav/_project.html.haml:73 [`visible_to_user`] [`.count`]
- [x]  app/services/merge_requests/build_service.rb:84 [`issue.try(:confidential?)`]
- [x]  lib/api/issues.rb:112 [`visible_to_user`]
  - CHANGELOG: Prevented API returning issues set to 'Only team members' to everyone
- [x]  lib/api/helpers.rb:126 [`can?(current_user, :read_issue, issue)`] Maybe here too?
- [x]  lib/gitlab/search_results.rb:53 [`visible_to_user`]

### Previous discussions
- [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b2ff264eddf9819d7693c14ae213d941494fe2b3_128_126
- [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#7b6375270d22f880bdcb085e47b519b426a5c6c7_87_87

See merge request !2031
2016-11-28 21:26:23 -03:00
Valery Sizov
03bed0fbd3 Clean up search result classes 2016-09-06 10:12:55 +03:00
tiagonbotelho
1d268a89de adds second batch of tests changed to active tense 2016-08-09 15:11:39 +01:00
Douglas Barbosa Alexandre
b56c456750 Project members with guest role can't access confidential issues 2016-06-13 19:32:00 -03:00
Douglas Barbosa Alexandre
f2ba4e3d36 Restrict access to confidential issues on search results 2016-03-17 20:55:59 -03:00
Yorick Peterse
013542965c Refactor Gitlab::SearchResults
Instead of plucking IDs this class now uses ActiveRecord::Relation
objects. Plucking IDs is problematic as searching for projects can lead
to a huge amount of IDs being loaded into memory only to be used as an
argument for another query (instead of just using a sub-query).
2016-03-11 15:25:22 -05:00