diff options
author | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-04-02 10:48:20 +0300 |
---|---|---|
committer | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-04-02 10:48:20 +0300 |
commit | b4e659a38e318ea26685467b0d437a9b4a5cd9cb (patch) | |
tree | 245d1d1357cfa8ea68552ebef19913e6fa5dc9fd /spec/controllers | |
parent | 85ad18b2dc656bb84d095b47a7faf5d904a3dfcd (diff) | |
parent | b641c654b19f6ac9374fe256802cf3ae5c3f2ed6 (diff) |
Merge branch 'security-mass-assignment-on-project-update' into 'master'
Disallow changing namespace of a project in update method
See merge request gitlab/gitlabhq!3028
Diffstat (limited to 'spec/controllers')
-rw-r--r-- | spec/controllers/projects_controller_spec.rb | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb index a1662658ade..356d606d5c5 100644 --- a/spec/controllers/projects_controller_spec.rb +++ b/spec/controllers/projects_controller_spec.rb @@ -369,6 +369,23 @@ describe ProjectsController do end end + it 'does not update namespace' do + controller.instance_variable_set(:@project, project) + + params = { + namespace_id: 'test' + } + + expect do + put :update, + params: { + namespace_id: project.namespace, + id: project.id, + project: params + } + end.not_to change { project.namespace.reload } + end + def update_project(**parameters) put :update, params: { |