diff options
author | Sean McGivern <sean@mcgivern.me.uk> | 2016-10-25 16:21:31 +0300 |
---|---|---|
committer | Sean McGivern <sean@mcgivern.me.uk> | 2016-10-25 16:21:31 +0300 |
commit | 9a6770388c0e93f98952a40cc88bb7f5ecd23631 (patch) | |
tree | e657ed07bb550ee3fad2a40a1a1e39d10455fcc2 | |
parent | ea8aa34b55f9029a823c6210258f8552fcaababe (diff) | |
parent | cabc131cfbee72e3a1eaae94619dcf1e3cc59d5a (diff) |
Merge branch 'board-dragging-disabled' into 'master'
Stop unauthorized users dragging on issue boards
Closes #23763
See merge request !7096
-rw-r--r-- | CHANGELOG.md | 3 | ||||
-rw-r--r-- | app/helpers/boards_helper.rb | 2 | ||||
-rw-r--r-- | spec/features/boards/boards_spec.rb | 4 |
3 files changed, 7 insertions, 2 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 2e25f0b2ceb..60f932e1f76 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,7 +23,8 @@ Please view this file on the master branch, on stable branches it's out of date. - Fixed hidden pipeline graph on commit and MR page !6895 - Expire and build repository cache after project import - Fix 404 for group pages when GitLab setup uses relative url - - Simpler arguments passed to named_route on toggle_award_url helper method + - Simpler arguments passed to named_route on toggle_award_url helper method + - Fix unauthorized users dragging on issue boards - Better handle when no users were selected for adding to group or project. (Linus Thiel) - Only show register tab if signup enabled. diff --git a/app/helpers/boards_helper.rb b/app/helpers/boards_helper.rb index b7247ffa8b2..38c586ccd31 100644 --- a/app/helpers/boards_helper.rb +++ b/app/helpers/boards_helper.rb @@ -5,7 +5,7 @@ module BoardsHelper { endpoint: namespace_project_boards_path(@project.namespace, @project), board_id: board.id, - disabled: !can?(current_user, :admin_list, @project), + disabled: "#{!can?(current_user, :admin_list, @project)}", issue_link_base: namespace_project_issues_path(@project.namespace, @project) } end diff --git a/spec/features/boards/boards_spec.rb b/spec/features/boards/boards_spec.rb index 0fb1608a0a3..c533ce1d87f 100644 --- a/spec/features/boards/boards_spec.rb +++ b/spec/features/boards/boards_spec.rb @@ -624,6 +624,10 @@ describe 'Issue Boards', feature: true, js: true do it 'does not show create new list' do expect(page).not_to have_selector('.js-new-board-list') end + + it 'does not allow dragging' do + expect(page).not_to have_selector('.user-can-drag') + end end context 'as guest user' do |