d1c94f034b
Exclude requesters from Project#members, Group#members and User#members ## What does this MR do? It excludes requesters from the `Project#members`, `Group#members` and `User#members` associations, and adds new `Project#requesters` and `Group#requesters` associations. ## Are there points in the code the reviewer needs to double check? No. ## Why was this MR needed? Without this, if you call `project.members`, requesters are included in the results! This is at best misleading, and at worst can lead to security issues. By excluding requesters from the `#members` associations, we avoid introducing security inadvertently since you have to call the `#requesters` association explicitly to get requesters. ## What are the relevant issue numbers? This is something I realized while fixing the security issue #19102. ## Does this MR meet the acceptance criteria? - [x] I don't think this needs a CHANGELOG since this is an internal change - Tests - [x] Added for this feature/bug - [ ] All builds are passing - [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides) - [x] Branch has no merge conflicts with `master` (if you do - rebase it please) - [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits) See merge request !4946 |
||
|---|---|---|
| .. | ||
| application_helper_spec.rb | ||
| auth_helper_spec.rb | ||
| blob_helper_spec.rb | ||
| broadcast_messages_helper_spec.rb | ||
| ci_status_helper_spec.rb | ||
| commits_helper_spec.rb | ||
| diff_helper_spec.rb | ||
| emails_helper_spec.rb | ||
| events_helper_spec.rb | ||
| form_helper_spec.rb | ||
| gitlab_markdown_helper_spec.rb | ||
| gitlab_routing_helper_spec.rb | ||
| graph_helper_spec.rb | ||
| groups_helper_spec.rb | ||
| icons_helper_spec.rb | ||
| import_helper_spec.rb | ||
| issues_helper_spec.rb | ||
| labels_helper_spec.rb | ||
| members_helper_spec.rb | ||
| merge_requests_helper_spec.rb | ||
| nav_helper_spec.rb | ||
| notes_helper_spec.rb | ||
| notifications_helper_spec.rb | ||
| page_layout_helper_spec.rb | ||
| preferences_helper_spec.rb | ||
| projects_helper_spec.rb | ||
| runners_helper_spec.rb | ||
| search_helper_spec.rb | ||
| submodule_helper_spec.rb | ||
| tab_helper_spec.rb | ||
| time_helper_spec.rb | ||
| tree_helper_spec.rb | ||
| visibility_level_helper_spec.rb | ||