Merge branch 'security-contributed-projects' into 'master'

[master] Fix contributed projects info is still visible even user enable private profile

See merge request gitlab/gitlabhq!2743

1 files changed, 12 insertions, 0 deletions

diff --git a/spec/finders/contributed_projects_finder_spec.rb b/spec/finders/contributed_projects_finder_spec.rb
index 81fb4e3561c..ee84fd067d4 100644
--- a/spec/finders/contributed_projects_finder_spec.rb
+++ b/spec/finders/contributed_projects_finder_spec.rb
@@ -31,4 +31,16 @@ describe ContributedProjectsFinder do
 
     it { is_expected.to match_array([private_project, internal_project, public_project]) }
   end
+
+  context 'user with private profile' do
+    it 'does not return contributed projects' do
+      private_user = create(:user, private_profile: true)
+      public_project.add_maintainer(private_user)
+      create(:push_event, project: public_project, author: private_user)
+
+      projects = described_class.new(private_user).execute(current_user)
+
+      expect(projects).to be_empty
+    end
+  end
 end