diff options
author | Cindy Pallares <cindy@gitlab.com> | 2018-11-28 21:38:24 +0300 |
---|---|---|
committer | Cindy Pallares <cindy@gitlab.com> | 2018-11-29 03:08:42 +0300 |
commit | 17f837267dc7e9e995885d9d161c7b035719de41 (patch) | |
tree | 86964ac47fbf6e4f2f193a261e9c82fb006a7e34 /spec/controllers/projects | |
parent | 94ab2d5fc80d71df5637e6bbe1f5272daf6aa38c (diff) |
Merge branch 'security-issue_51301' into 'master'
[master] Resolve: Promoting a milestone is missing an authorization check
See merge request gitlab/gitlabhq!2598
Diffstat (limited to 'spec/controllers/projects')
-rw-r--r-- | spec/controllers/projects/milestones_controller_spec.rb | 33 |
1 files changed, 27 insertions, 6 deletions
diff --git a/spec/controllers/projects/milestones_controller_spec.rb b/spec/controllers/projects/milestones_controller_spec.rb index ccd4fc4db3a..658aa2a6738 100644 --- a/spec/controllers/projects/milestones_controller_spec.rb +++ b/spec/controllers/projects/milestones_controller_spec.rb @@ -143,11 +143,27 @@ describe Projects::MilestonesController do end describe '#promote' do + let(:group) { create(:group) } + + before do + project.update(namespace: group) + end + + context 'when user does not have permission to promote milestone' do + before do + group.add_guest(user) + end + + it 'renders 404' do + post :promote, namespace_id: project.namespace.id, project_id: project.id, id: milestone.iid + + expect(response).to have_gitlab_http_status(404) + end + end + context 'promotion succeeds' do before do - group = create(:group) group.add_developer(user) - milestone.project.update(namespace: group) end it 'shows group milestone' do @@ -166,12 +182,17 @@ describe Projects::MilestonesController do end end - context 'promotion fails' do - it 'shows project milestone' do + context 'when user cannot admin group milestones' do + before do + project.add_developer(user) + end + + it 'renders 404' do + project.update(namespace: user.namespace) + post :promote, namespace_id: project.namespace.id, project_id: project.id, id: milestone.iid - expect(response).to redirect_to(project_milestone_path(project, milestone)) - expect(flash[:alert]).to eq('Promotion failed - Project does not belong to a group.') + expect(response).to have_gitlab_http_status(404) end end end |