diff options
author | Stan Hu <stanhu@gmail.com> | 2016-10-28 19:44:35 +0300 |
---|---|---|
committer | Stan Hu <stanhu@gmail.com> | 2016-10-28 19:44:35 +0300 |
commit | e8ecc1a069e6bcdacb540cf9a5f57c31cf406a60 (patch) | |
tree | 3c6d2e5ebeee342e5adeeee95706c1da900087fe /app/services | |
parent | 5742f4a6287927972790d9f20d671c505f149856 (diff) | |
parent | 61e2b88dd11431ea865455ec8ced3d4f6735a67d (diff) |
Merge branch 'ee-1159-allow-permission-check-bypass-in-approve-access-request-service' into 'master'
Allow Members::ApproveAccessRequestService to accept a new `:force` option
## What does this MR do?
See the commit message.
This is a backport of the EE fix for https://gitlab.com/gitlab-org/gitlab-ee/issues/1159: gitlab-org/gitlab-ee!830
See merge request !7168
Diffstat (limited to 'app/services')
-rw-r--r-- | app/services/members/approve_access_request_service.rb | 21 |
1 files changed, 16 insertions, 5 deletions
diff --git a/app/services/members/approve_access_request_service.rb b/app/services/members/approve_access_request_service.rb index 416aee2ab51..c13f289f61e 100644 --- a/app/services/members/approve_access_request_service.rb +++ b/app/services/members/approve_access_request_service.rb @@ -4,17 +4,25 @@ module Members attr_accessor :source + # source - The source object that respond to `#requesters` (i.g. project or group) + # current_user - The user that performs the access request approval + # params - A hash of parameters + # :user_id - User ID used to retrieve the access requester + # :id - Member ID used to retrieve the access requester + # :access_level - Optional access level set when the request is accepted def initialize(source, current_user, params = {}) @source = source @current_user = current_user - @params = params + @params = params.slice(:user_id, :id, :access_level) end - def execute + # opts - A hash of options + # :force - Bypass permission check: current_user can be nil in that case + def execute(opts = {}) condition = params[:user_id] ? { user_id: params[:user_id] } : { id: params[:id] } access_requester = source.requesters.find_by!(condition) - raise Gitlab::Access::AccessDeniedError unless can_update_access_requester?(access_requester) + raise Gitlab::Access::AccessDeniedError unless can_update_access_requester?(access_requester, opts) access_requester.access_level = params[:access_level] if params[:access_level] access_requester.accept_request @@ -24,8 +32,11 @@ module Members private - def can_update_access_requester?(access_requester) - access_requester && can?(current_user, action_member_permission(:update, access_requester), access_requester) + def can_update_access_requester?(access_requester, opts = {}) + access_requester && ( + opts[:force] || + can?(current_user, action_member_permission(:update, access_requester), access_requester) + ) end end end |