670b2eb5c0
API: Share projects only with groups current_user can access
Aims to address the issues here: https://gitlab.com/gitlab-org/gitlab-ce/issues/23004
* Projects can be shared with non-existent groups
* Projects can be shared with groups that the current user does not have access to read
Concerns:
The new implementation of the API endpoint allows projects to be shared with a larger range of groups than can be done via the web UI.
The form for sharing a project with a group uses the following API endpoint to index the available groups: 494269fc92/lib/api/groups.rb (L17). The groups indexed in the web form will only be those groups that the user is currently a member of.
The new implementation allows projects to be shared with any group that the authenticated user has access to view. This widens the range of groups to those that are public and internal.
See merge request !2005
Signed-off-by: Rémy Coutable <remy@rymai.me>
38 lines
896 B
Ruby
38 lines
896 B
Ruby
class ProjectGroupLink < ActiveRecord::Base
|
|
include Expirable
|
|
|
|
GUEST = 10
|
|
REPORTER = 20
|
|
DEVELOPER = 30
|
|
MASTER = 40
|
|
|
|
belongs_to :project
|
|
belongs_to :group
|
|
|
|
validates :project_id, presence: true
|
|
validates :group, presence: true
|
|
validates :group_id, uniqueness: { scope: [:project_id], message: "already shared with this group" }
|
|
validates :group_access, presence: true
|
|
validates :group_access, inclusion: { in: Gitlab::Access.values }, presence: true
|
|
validate :different_group
|
|
|
|
def self.access_options
|
|
Gitlab::Access.options
|
|
end
|
|
|
|
def self.default_access
|
|
DEVELOPER
|
|
end
|
|
|
|
def human_access
|
|
self.class.access_options.key(self.group_access)
|
|
end
|
|
|
|
private
|
|
|
|
def different_group
|
|
if self.group && self.project && self.project.group == self.group
|
|
errors.add(:base, "Project cannot be shared with the project it is in.")
|
|
end
|
|
end
|
|
end
|