gitlab-org--gitlab-foss/spec/models
Douwe Maan 6d37fe952b Merge branch 'jej-fix-missing-access-check-on-issues' into 'security'
Fix missing access checks on issue lookup using IssuableFinder

Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867

⚠️ - Potentially untested
💣 - No test coverage
🚥 - Test coverage of some sort exists (a test failed when error raised)
🚦 - Test coverage of return value (a test failed when nil used)
 - Permissions check tested

- [x]  app/controllers/projects/branches_controller.rb:39
  - `before_action :authorize_push_code!` helpes limit/prevent exploitation. Always checks for reporter access so fine with
    confidential issues, issues only visible to team, etc.
- [x] 🚥 app/models/cycle_analytics/summary.rb:9 [`.count`]
- [x]  app/controllers/projects/todos_controller.rb:19

- [x] Potential double render in app/controllers/projects/todos_controller.rb

- https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#cedccb227af9bfdf88802767cb58d43c2b977439_24_24

See merge request !2030
2016-11-28 21:25:46 -03:00
..
ci Merge branch 'fix-cancelling-pipelines' into 'master' 2016-11-25 09:48:04 +00:00
concerns Merge branch 'fix-cancelling-pipelines' into 'master' 2016-11-25 09:48:04 +00:00
cycle_analytics Merge branch 'jej-fix-missing-access-check-on-issues' into 'security' 2016-11-28 21:25:46 -03:00
hooks
issue
members Optimize Event queries by removing default order 2016-10-27 20:07:11 -03:00
merge_request
network
project_services Merge branch 'issue_5541' into 'master' 2016-11-21 11:07:46 +00:00
ability_spec.rb
abuse_report_spec.rb
appearance_spec.rb
application_setting_spec.rb Refine Git garbage collection 2016-11-04 14:30:11 +01:00
award_emoji_spec.rb
blob_spec.rb
board_spec.rb
broadcast_message_spec.rb Use build instead create in BroadcastMessage model spec 2016-11-19 03:22:02 +05:00
build_spec.rb Fix tests and add has_environment? 2016-11-17 12:08:28 +01:00
chat_name_spec.rb Add most of specs for chat names 2016-11-17 21:34:23 +01:00
commit_range_spec.rb
commit_spec.rb There's no such method 2016-11-04 00:00:03 +08:00
commit_status_spec.rb
compare_spec.rb
deploy_key_spec.rb
deploy_keys_project_spec.rb
deployment_spec.rb
diff_note_spec.rb
discussion_spec.rb
email_spec.rb refactor(email): use setter method instead AR callbacks 2016-10-23 17:30:07 +05:00
environment_spec.rb Introduce deploy command that allows to start deployment from one environment to second one 2016-11-21 17:26:35 +01:00
event_spec.rb Removed data-user-is view code 2016-11-25 13:45:34 +01:00
external_issue_spec.rb Add the method ExternalIssue#project_id 2016-11-07 12:49:24 +01:00
forked_project_link_spec.rb
generic_commit_status_spec.rb
global_milestone_spec.rb
group_label_spec.rb Remove order-dependent expectation 2016-11-09 19:50:32 +01:00
group_spec.rb Make access request specs explicitly enable or disable access requests as required 2016-11-11 15:45:47 +00:00
guest_spec.rb Merge branch 'fix-unathorized-cloning' into 'security' 2016-11-09 12:27:17 +01:00
identity_spec.rb
issue_collection_spec.rb Process commits in a separate worker 2016-11-07 13:11:44 +01:00
issue_spec.rb Drop Project#authorized_for_user? in favor of ProjectTeam#member? 2016-11-23 12:57:58 +02:00
key_spec.rb Use Gitlab.config.gitlab.host over 'localhost' 2016-11-18 20:17:10 +08:00
label_link_spec.rb
label_priority_spec.rb Add support to group labels prioritization on project level 2016-10-19 14:58:27 -02:00
label_spec.rb Abstract LabelPriority away into methods on Label model 2016-10-19 14:58:27 -02:00
legacy_diff_note_spec.rb
list_spec.rb
member_spec.rb Precalculate user's authorized projects in database 2016-11-18 20:25:45 +02:00
merge_request_diff_spec.rb
merge_request_spec.rb Correctly determine mergeability of MR with no discussions 2016-11-23 20:02:14 +08:00
milestone_spec.rb Add a starting date to milestones 2016-11-23 13:41:04 +02:00
namespace_spec.rb
note_spec.rb Rephrase some system notes to be compatible with new system note style 2016-11-24 18:26:29 +08:00
notification_setting_spec.rb
personal_access_token_spec.rb
project_feature_spec.rb
project_group_link_spec.rb Precalculate user's authorized projects in database 2016-11-18 20:25:45 +02:00
project_label_spec.rb Add subject to group and projects labels which return group/project 2016-10-19 14:58:27 -02:00
project_snippet_spec.rb
project_spec.rb Drop Project#authorized_for_user? in favor of ProjectTeam#member? 2016-11-23 12:57:58 +02:00
project_team_spec.rb Update ProjectTeam#fetch_members to use project authorizations 2016-11-23 12:59:13 +02:00
project_wiki_spec.rb
protected_branch_spec.rb
release_spec.rb
repository_spec.rb Pass tag SHA to post-receive hook when tag is created via UI 2016-11-28 15:04:51 +01:00
service_spec.rb Remove empty describe block in service spec 2016-11-22 21:27:16 +05:00
snippet_spec.rb
spam_log_spec.rb
subscription_spec.rb Allow subscriptions to be created without a project 2016-11-17 15:10:13 -02:00
todo_spec.rb
tree_spec.rb
trending_project_spec.rb
user_agent_detail_spec.rb
user_spec.rb Refresh project authorizations using a Redis lease 2016-11-25 13:35:01 +01:00
wiki_page_spec.rb