742cee756b
Fix information disclosure in `Projects::BlobController#update` It was possible to discover private project names by modifying `from_merge_request`parameter in `Projects::BlobController#update`. This fixes that. - [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.md) entry added - Tests - [x] Added for this feature/bug - [ ] All builds are passing - [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html) - [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides) - [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits) https://gitlab.com/gitlab-org/gitlab-ce/issues/22869 See merge request !2023
45 lines
1.2 KiB
Ruby
45 lines
1.2 KiB
Ruby
require 'spec_helper'
|
|
|
|
feature 'Editing file blob', feature: true, js: true do
|
|
include WaitForAjax
|
|
|
|
given(:user) { create(:user) }
|
|
given(:role) { :developer }
|
|
given(:merge_request) { create(:merge_request, source_branch: 'feature', target_branch: 'master') }
|
|
given(:project) { merge_request.target_project }
|
|
|
|
background do
|
|
login_as(user)
|
|
project.team << [user, role]
|
|
end
|
|
|
|
def edit_and_commit
|
|
wait_for_ajax
|
|
first('.file-actions').click_link 'Edit'
|
|
execute_script('ace.edit("editor").setValue("class NextFeature\nend\n")')
|
|
click_button 'Commit Changes'
|
|
end
|
|
|
|
context 'from MR diff' do
|
|
before do
|
|
visit diffs_namespace_project_merge_request_path(project.namespace, project, merge_request)
|
|
edit_and_commit
|
|
end
|
|
|
|
scenario 'returns me to the mr' do
|
|
expect(page).to have_content(merge_request.title)
|
|
end
|
|
end
|
|
|
|
context 'from blob file path' do
|
|
before do
|
|
visit namespace_project_blob_path(project.namespace, project, '/feature/files/ruby/feature.rb')
|
|
edit_and_commit
|
|
end
|
|
|
|
scenario 'updates content' do
|
|
expect(page).to have_content 'successfully committed'
|
|
expect(page).to have_content 'NextFeature'
|
|
end
|
|
end
|
|
end
|