gitlab-org--gitlab-foss/spec/controllers/projects
Douwe Maan 742cee756b Merge branch 'jej-22869' into 'security'
Fix information disclosure in `Projects::BlobController#update`

It was possible to discover private project names by modifying `from_merge_request`parameter in `Projects::BlobController#update`. This fixes that.

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.md) entry added
- Tests
  - [x] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

https://gitlab.com/gitlab-org/gitlab-ce/issues/22869

See merge request !2023
2016-11-28 21:25:18 -03:00
..
boards Remove default value for project argument on subscribable concern 2016-11-17 15:10:13 -02:00
avatars_controller_spec.rb fixes part1 of files to start using active tense 2016-08-09 15:06:23 +01:00
blame_controller_spec.rb
blob_controller_spec.rb Merge branch 'jej-22869' into 'security' 2016-11-28 21:25:18 -03:00
boards_controller_spec.rb Update Projects::BoardsController#show to look up for a specific board 2016-10-11 11:39:05 -03:00
branches_controller_spec.rb Add button to delete all merged branches 2016-11-09 21:04:03 +01:00
commit_controller_spec.rb refactors tests because of gitlab-test repository changes 2016-10-11 16:33:06 +01:00
commits_controller_spec.rb Allow browsing branches that end with '.atom' 2016-10-11 13:31:12 +01:00
compare_controller_spec.rb fixes part1 of files to start using active tense 2016-08-09 15:06:23 +01:00
cycle_analytics_controller_spec.rb Updated code based on feedback 2016-11-21 17:29:07 +01:00
discussions_controller_spec.rb Address review feedback 2016-08-16 11:04:26 -05:00
environments_controller_spec.rb Add controller specs for environments index action 2016-11-16 11:58:06 +00:00
find_file_controller_spec.rb
forks_controller_spec.rb Remove newlines between context and it in addition to testing redirection for create action to import path 2016-11-15 21:23:20 +03:00
graphs_controller_spec.rb Fix indentation and change inner matcher 2016-10-13 13:08:19 +02:00
group_links_controller_spec.rb fix group links 404 2016-10-05 09:57:54 +01:00
imports_controller_spec.rb
issues_controller_spec.rb Refresh todos count cache when an Issue/MR is deleted 2016-09-08 15:50:07 -03:00
labels_controller_spec.rb Add helper method to toggle label subscription on labels controller spec 2016-11-17 15:10:13 -02:00
merge_requests_controller_spec.rb Ensure labels are loaded on "show" methods of MR 2016-11-11 14:06:43 -04:00
milestones_controller_spec.rb Rephrase some system notes to be compatible with new system note style 2016-11-24 18:26:29 +08:00
notes_controller_spec.rb Address review feedback 2016-08-16 11:04:26 -05:00
project_members_controller_spec.rb Make access request specs explicitly enable or disable access requests as required 2016-11-11 15:45:47 +00:00
protected_branches_controller_spec.rb fixes part1 of files to start using active tense 2016-08-09 15:06:23 +01:00
raw_controller_spec.rb fixes part1 of files to start using active tense 2016-08-09 15:06:23 +01:00
refs_controller_spec.rb
repositories_controller_spec.rb Fix test failure by accessing Content-Type header directly. 2016-09-27 20:52:41 -06:00
services_controller_spec.rb Fix missing flash messages on service edit page 2016-09-05 14:13:15 +03:00
snippets_controller_spec.rb Project tools visibility level 2016-09-01 11:47:59 -03:00
tags_controller_spec.rb Respond with 404 Not Found for non-existent tags 2016-10-05 19:28:39 +02:00
templates_controller_spec.rb Allow Member.add_user to handle access requesters 2016-09-28 09:43:00 +02:00
todo_controller_spec.rb Cache todos pending/done dashboard query counts 2016-07-12 18:57:52 +02:00
tree_controller_spec.rb Enable Style/EmptyLines cop, remove redundant ones 2016-07-01 21:56:17 +02:00
uploads_controller_spec.rb Get rid of is_image in FileUploader 2016-07-19 18:51:09 +02:00