diff options
author | Shinya Maeda <shinya@gitlab.com> | 2019-01-29 12:25:53 +0300 |
---|---|---|
committer | Shinya Maeda <shinya@gitlab.com> | 2019-01-30 09:52:59 +0300 |
commit | f942a08d23923afc7c99d750922ff61018cbcbf8 (patch) | |
tree | 655515f6085c17802682591b99515520a222ced2 /spec/requests/api/releases_spec.rb | |
parent | aca9ce3eb61b4af37ee47daaf03c5e1e7a06a15d (diff) |
Fix Markdown of release notes
It was leaings confidential issue titles and MR titles to any users
Fix spec
Fix spec
Fix tests
Diffstat (limited to 'spec/requests/api/releases_spec.rb')
-rw-r--r-- | spec/requests/api/releases_spec.rb | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/spec/requests/api/releases_spec.rb b/spec/requests/api/releases_spec.rb index 811e23fb854..1f317971a66 100644 --- a/spec/requests/api/releases_spec.rb +++ b/spec/requests/api/releases_spec.rb @@ -127,6 +127,31 @@ describe API::Releases do .to match_array(release.sources.map(&:url)) end + context "when release description contains confidential issue's link" do + let(:confidential_issue) do + create(:issue, + :confidential, + project: project, + title: 'A vulnerability') + end + + let!(:release) do + create(:release, + project: project, + tag: 'v0.1', + sha: commit.id, + author: maintainer, + description: "This is confidential #{confidential_issue.to_reference}") + end + + it "does not expose confidential issue's title" do + get api("/projects/#{project.id}/releases/v0.1", maintainer) + + expect(json_response['description_html']).to include(confidential_issue.to_reference) + expect(json_response['description_html']).not_to include('A vulnerability') + end + end + context 'when release has link asset' do let!(:link) do create(:release_link, |