diff options
author | Bob Van Landuyt <bob@vanlanduyt.co> | 2018-12-06 19:04:34 +0300 |
---|---|---|
committer | Bob Van Landuyt <bob@vanlanduyt.co> | 2018-12-14 12:21:09 +0300 |
commit | 08dbd93bd6e08bca179567a3c020b8fac5139b49 (patch) | |
tree | 688b1e4398b7eb8e78f37486e74fa0c01a6be279 /spec/features | |
parent | 352af3e57220e3f0178da8de2c3f03c42c419a9b (diff) |
Validate projects in MR build service
This validates the correct abilities for both projects. Only
`read_project` isn't enough:
For the `source_project` we validate `create_merge_request_from` this
also validates that the user has developer access to the project.
For the `target_project` we validate `create_merge_reqeust_in` this
also validates that the user has access to the project's repository.
To avoid generating diffs for unrelated projects we also validate that
the projects are in the same fork network now.
Diffstat (limited to 'spec/features')
-rw-r--r-- | spec/features/merge_request/user_tries_to_access_private_repository_through_new_mr_spec.rb | 37 |
1 files changed, 37 insertions, 0 deletions
diff --git a/spec/features/merge_request/user_tries_to_access_private_repository_through_new_mr_spec.rb b/spec/features/merge_request/user_tries_to_access_private_repository_through_new_mr_spec.rb new file mode 100644 index 00000000000..9318b5f1ebb --- /dev/null +++ b/spec/features/merge_request/user_tries_to_access_private_repository_through_new_mr_spec.rb @@ -0,0 +1,37 @@ +require 'spec_helper' + +describe 'Merge Request > Tries to access private repo of public project' do + let(:current_user) { create(:user) } + let(:private_project) do + create(:project, :public, :repository, + path: 'nothing-to-see-here', + name: 'nothing to see here', + repository_access_level: ProjectFeature::PRIVATE) + end + let(:owned_project) do + create(:project, :public, :repository, + namespace: current_user.namespace, + creator: current_user) + end + + context 'when the user enters the querystring info for the other project' do + let(:mr_path) do + project_new_merge_request_diffs_path( + owned_project, + merge_request: { + source_project_id: private_project.id, + source_branch: 'feature' + } + ) + end + + before do + sign_in current_user + visit mr_path + end + + it "does not mention the project the user can't see the repo of" do + expect(page).not_to have_content('nothing-to-see-here') + end + end +end |