3bf34face4
Replace issue access checks with use of IssuableFinder Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867 ## Which fixes are in this MR? ⚠️ - Potentially untested 💣 - No test coverage 🚥 - Test coverage of some sort exists (a test failed when error raised) 🚦 - Test coverage of return value (a test failed when nil used) ✅ - Permissions check tested ### Issue lookup with access check Using `visible_to_user` likely makes these security issues too. See [Code smells](#code-smells). - [x] 🚦 app/finders/notes_finder.rb:15 [`visible_to_user`] - [x] 🚥 app/views/layouts/nav/_project.html.haml:73 [`visible_to_user`] [`.count`] - [x] ✅ app/services/merge_requests/build_service.rb:84 [`issue.try(:confidential?)`] - [x] ✅ lib/api/issues.rb:112 [`visible_to_user`] - CHANGELOG: Prevented API returning issues set to 'Only team members' to everyone - [x] ✅ lib/api/helpers.rb:126 [`can?(current_user, :read_issue, issue)`] Maybe here too? - [x] ✅ lib/gitlab/search_results.rb:53 [`visible_to_user`] ### Previous discussions - [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b2ff264eddf9819d7693c14ae213d941494fe2b3_128_126 - [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#7b6375270d22f880bdcb085e47b519b426a5c6c7_87_87 See merge request !2031
119 lines
3.9 KiB
Ruby
119 lines
3.9 KiB
Ruby
module MergeRequests
|
|
class BuildService < MergeRequests::BaseService
|
|
def execute
|
|
merge_request = MergeRequest.new(params)
|
|
|
|
# Set MR attributes
|
|
merge_request.can_be_created = true
|
|
merge_request.compare_commits = []
|
|
merge_request.source_project = project unless merge_request.source_project
|
|
|
|
merge_request.target_project = nil unless can?(current_user, :read_project, merge_request.target_project)
|
|
|
|
merge_request.target_project ||= (project.forked_from_project || project)
|
|
merge_request.target_branch ||= merge_request.target_project.default_branch
|
|
|
|
messages = validate_branches(merge_request)
|
|
return build_failed(merge_request, messages) unless messages.empty?
|
|
|
|
compare = CompareService.new.execute(
|
|
merge_request.source_project,
|
|
merge_request.source_branch,
|
|
merge_request.target_project,
|
|
merge_request.target_branch,
|
|
)
|
|
|
|
merge_request.compare_commits = compare.commits
|
|
merge_request.compare = compare
|
|
|
|
set_title_and_description(merge_request)
|
|
end
|
|
|
|
private
|
|
|
|
def validate_branches(merge_request)
|
|
messages = []
|
|
|
|
if merge_request.target_branch.blank? || merge_request.source_branch.blank?
|
|
messages <<
|
|
if params[:source_branch] || params[:target_branch]
|
|
"You must select source and target branch"
|
|
end
|
|
end
|
|
|
|
if merge_request.source_project == merge_request.target_project &&
|
|
merge_request.target_branch == merge_request.source_branch
|
|
|
|
messages << 'You must select different branches'
|
|
end
|
|
|
|
# See if source and target branches exist
|
|
if merge_request.source_branch.present? && !merge_request.source_project.commit(merge_request.source_branch)
|
|
messages << "Source branch \"#{merge_request.source_branch}\" does not exist"
|
|
end
|
|
|
|
if merge_request.target_branch.present? && !merge_request.target_project.commit(merge_request.target_branch)
|
|
messages << "Target branch \"#{merge_request.target_branch}\" does not exist"
|
|
end
|
|
|
|
messages
|
|
end
|
|
|
|
# When your branch name starts with an iid followed by a dash this pattern will be
|
|
# interpreted as the user wants to close that issue on this project.
|
|
#
|
|
# For example:
|
|
# - Issue 112 exists, title: Emoji don't show up in commit title
|
|
# - Source branch is: 112-fix-mep-mep
|
|
#
|
|
# Will lead to:
|
|
# - Appending `Closes #112` to the description
|
|
# - Setting the title as 'Resolves "Emoji don't show up in commit title"' if there is
|
|
# more than one commit in the MR
|
|
#
|
|
def set_title_and_description(merge_request)
|
|
if match = merge_request.source_branch.match(/\A(\d+)-/)
|
|
iid = match[1]
|
|
end
|
|
|
|
commits = merge_request.compare_commits
|
|
if commits && commits.count == 1
|
|
commit = commits.first
|
|
merge_request.title = commit.title
|
|
merge_request.description ||= commit.description.try(:strip)
|
|
elsif iid && issue = merge_request.target_project.get_issue(iid, current_user)
|
|
case issue
|
|
when Issue
|
|
merge_request.title = "Resolve \"#{issue.title}\""
|
|
when ExternalIssue
|
|
merge_request.title = "Resolve #{issue.title}"
|
|
end
|
|
else
|
|
merge_request.title = merge_request.source_branch.titleize.humanize
|
|
end
|
|
|
|
if iid
|
|
closes_issue = "Closes ##{iid}"
|
|
|
|
if merge_request.description.present?
|
|
merge_request.description += closes_issue.prepend("\n\n")
|
|
else
|
|
merge_request.description = closes_issue
|
|
end
|
|
end
|
|
|
|
merge_request.title = merge_request.wip_title if commits.empty?
|
|
|
|
merge_request
|
|
end
|
|
|
|
def build_failed(merge_request, messages)
|
|
messages.compact.each do |message|
|
|
merge_request.errors.add(:base, message)
|
|
end
|
|
merge_request.compare_commits = []
|
|
merge_request.can_be_created = false
|
|
merge_request
|
|
end
|
|
end
|
|
end
|