6d37fe952b
Fix missing access checks on issue lookup using IssuableFinder Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867 ⚠️ - Potentially untested 💣 - No test coverage 🚥 - Test coverage of some sort exists (a test failed when error raised) 🚦 - Test coverage of return value (a test failed when nil used) ✅ - Permissions check tested - [x] ✅ app/controllers/projects/branches_controller.rb:39 - `before_action :authorize_push_code!` helpes limit/prevent exploitation. Always checks for reporter access so fine with confidential issues, issues only visible to team, etc. - [x] 🚥 app/models/cycle_analytics/summary.rb:9 [`.count`] - [x] ✅ app/controllers/projects/todos_controller.rb:19 - [x] Potential double render in app/controllers/projects/todos_controller.rb - https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#cedccb227af9bfdf88802767cb58d43c2b977439_24_24 See merge request !2030
43 lines
1.1 KiB
Ruby
43 lines
1.1 KiB
Ruby
class CycleAnalytics
|
|
class Summary
|
|
def initialize(project, current_user, from:)
|
|
@project = project
|
|
@current_user = current_user
|
|
@from = from
|
|
end
|
|
|
|
def new_issues
|
|
IssuesFinder.new(@current_user, project_id: @project.id).execute.created_after(@from).count
|
|
end
|
|
|
|
def commits
|
|
ref = @project.default_branch.presence
|
|
count_commits_for(ref)
|
|
end
|
|
|
|
def deploys
|
|
@project.deployments.where("created_at > ?", @from).count
|
|
end
|
|
|
|
private
|
|
|
|
# Don't use the `Gitlab::Git::Repository#log` method, because it enforces
|
|
# a limit. Since we need a commit count, we _can't_ enforce a limit, so
|
|
# the easiest way forward is to replicate the relevant portions of the
|
|
# `log` function here.
|
|
def count_commits_for(ref)
|
|
return unless ref
|
|
|
|
repository = @project.repository.raw_repository
|
|
sha = @project.repository.commit(ref).sha
|
|
|
|
cmd = %W(git --git-dir=#{repository.path} log)
|
|
cmd << '--format=%H'
|
|
cmd << "--after=#{@from.iso8601}"
|
|
cmd << sha
|
|
|
|
raw_output = IO.popen(cmd) { |io| io.read }
|
|
raw_output.lines.count
|
|
end
|
|
end
|
|
end
|