diff options
author | Shinya Maeda <shinya@gitlab.com> | 2017-09-04 15:53:19 +0300 |
---|---|---|
committer | Shinya Maeda <shinya@gitlab.com> | 2017-09-04 15:53:19 +0300 |
commit | 2f906430fa9efa61b7808e5849611fef6ecb59a5 (patch) | |
tree | 8022488fcb64c2e7f92d95636ac30f87b703092e /spec/requests | |
parent | bb22989c388bb7322e95af72c48d8422494d96e7 (diff) |
Fix security breaching
Diffstat (limited to 'spec/requests')
-rw-r--r-- | spec/requests/api/pipeline_schedules_spec.rb | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/spec/requests/api/pipeline_schedules_spec.rb b/spec/requests/api/pipeline_schedules_spec.rb index 86e834b5a22..f650df57383 100644 --- a/spec/requests/api/pipeline_schedules_spec.rb +++ b/spec/requests/api/pipeline_schedules_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' describe API::PipelineSchedules do set(:developer) { create(:user) } set(:user) { create(:user) } - set(:project) { create(:project, :repository) } + set(:project) { create(:project, :repository, public_builds: false) } before do project.add_developer(developer) @@ -110,6 +110,18 @@ describe API::PipelineSchedules do end end + context 'authenticated user with insufficient permissions' do + before do + project.add_guest(user) + end + + it 'does not return pipeline_schedules list' do + get api("/projects/#{project.id}/pipeline_schedules/#{pipeline_schedule.id}", user) + + expect(response).to have_http_status(:not_found) + end + end + context 'unauthenticated user' do it 'does not return pipeline_schedules list' do get api("/projects/#{project.id}/pipeline_schedules/#{pipeline_schedule.id}") |