diff options
author | GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com> | 2023-06-29 11:22:26 +0300 |
---|---|---|
committer | GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com> | 2023-06-29 11:22:26 +0300 |
commit | 751cb432aab9837d3174bcdb309fae765925c869 (patch) | |
tree | 96b513d6f2fb66af92cf69de69c40487a980e2d4 /app | |
parent | 7b848eda5589ff5fa1bc3c6f782fc907c59a4417 (diff) | |
parent | 9ce736bb2cdbb3e28c522af172d595826f03d516 (diff) |
Merge remote-tracking branch 'dev/16-1-stable' into 16-1-stable
Diffstat (limited to 'app')
-rw-r--r-- | app/controllers/concerns/analytics/cycle_analytics/value_stream_actions.rb | 7 | ||||
-rw-r--r-- | app/controllers/import/github_controller.rb | 13 | ||||
-rw-r--r-- | app/controllers/projects/compare_controller.rb | 12 | ||||
-rw-r--r-- | app/helpers/users_helper.rb | 2 | ||||
-rw-r--r-- | app/models/hooks/web_hook.rb | 1 |
5 files changed, 27 insertions, 8 deletions
diff --git a/app/controllers/concerns/analytics/cycle_analytics/value_stream_actions.rb b/app/controllers/concerns/analytics/cycle_analytics/value_stream_actions.rb index f10b23d1664..cf0430307a3 100644 --- a/app/controllers/concerns/analytics/cycle_analytics/value_stream_actions.rb +++ b/app/controllers/concerns/analytics/cycle_analytics/value_stream_actions.rb @@ -7,6 +7,9 @@ module Analytics included do before_action :authorize + # Defining the before action here, because in the EE module we cannot define a before_action. + # Reason: this is a module which is being included into a controller. This module is extended in EE. + before_action :authorize_modification, only: %i[create destroy update] # rubocop:disable Rails/LexicallyScopedActionFilter end def index @@ -25,6 +28,10 @@ module Analytics def authorize authorize_read_cycle_analytics! end + + def authorize_modification + # no-op, overridden in EE + end end end end diff --git a/app/controllers/import/github_controller.rb b/app/controllers/import/github_controller.rb index 41477519ba5..12210afd44a 100644 --- a/app/controllers/import/github_controller.rb +++ b/app/controllers/import/github_controller.rb @@ -7,6 +7,8 @@ class Import::GithubController < Import::BaseController include ActionView::Helpers::SanitizeHelper include Import::GithubOauth + before_action :authorize_owner_access!, except: [:new, :callback, :personal_access_token, :status, :details, :create, + :realtime_changes, :cancel_all, :counts] before_action :verify_import_enabled before_action :provider_auth, only: [:status, :realtime_changes, :create] before_action :expire_etag_cache, only: [:status, :create] @@ -92,8 +94,6 @@ class Import::GithubController < Import::BaseController end def failures - project = Project.imported_from(provider_name).find(params[:project_id]) - unless project.import_finished? return render status: :bad_request, json: { message: _('The import is not complete.') @@ -107,7 +107,6 @@ class Import::GithubController < Import::BaseController end def cancel - project = Project.imported_from(provider_name).find(params[:project_id]) result = Import::Github::CancelProjectImportService.new(project, current_user).execute if result[:status] == :success @@ -168,6 +167,14 @@ class Import::GithubController < Import::BaseController private + def project + @project ||= Project.imported_from(provider_name).find(params[:project_id]) + end + + def authorize_owner_access! + return render_404 unless current_user.can?(:owner_access, project) + end + def import_params params.permit(permitted_import_params) end diff --git a/app/controllers/projects/compare_controller.rb b/app/controllers/projects/compare_controller.rb index 266edd506d5..599bfd75e14 100644 --- a/app/controllers/projects/compare_controller.rb +++ b/app/controllers/projects/compare_controller.rb @@ -89,10 +89,14 @@ class Projects::CompareController < Projects::ApplicationController # target == start_ref == from def target_project strong_memoize(:target_project) do - next source_project.default_merge_request_target unless compare_params.key?(:from_project_id) - next source_project if compare_params[:from_project_id].to_i == source_project.id - - target_project = target_projects(source_project).find_by_id(compare_params[:from_project_id]) + target_project = + if !compare_params.key?(:from_project_id) + source_project.default_merge_request_target + elsif compare_params[:from_project_id].to_i == source_project.id + source_project + else + target_projects(source_project).find_by_id(compare_params[:from_project_id]) + end # Just ignore the field if it points at a non-existent or hidden project next source_project unless target_project && can?(current_user, :read_code, target_project) diff --git a/app/helpers/users_helper.rb b/app/helpers/users_helper.rb index c8002c437a9..acc7d8a5a10 100644 --- a/app/helpers/users_helper.rb +++ b/app/helpers/users_helper.rb @@ -136,7 +136,7 @@ module UsersHelper def confirm_user_data(user) message = if user.unconfirmed_email.present? - _('This user has an unconfirmed email address (%{email}). You may force a confirmation.') % { email: user.unconfirmed_email } + safe_format(_('This user has an unconfirmed email address (%{email}). You may force a confirmation.'), email: user.unconfirmed_email) else _('This user has an unconfirmed email address. You may force a confirmation.') end diff --git a/app/models/hooks/web_hook.rb b/app/models/hooks/web_hook.rb index 6dc1c9f290a..d7a95363337 100644 --- a/app/models/hooks/web_hook.rb +++ b/app/models/hooks/web_hook.rb @@ -135,6 +135,7 @@ class WebHook < ApplicationRecord return if url_variables_were.blank? || interpolated_url_was == interpolated_url + self.url_variables = {} if url_variables_were.keys.intersection(url_variables.keys).any? self.url_variables = {} if url_changed? && url_variables_were.to_a.intersection(url_variables.to_a).any? end |