Merge branch 'bvl-security-9-2-28917-contain-uploads-in-system-dir' into 'security-9-2'

(security-9-2) Upload files into `public/upload/system` instead of `public/upload`

See merge request !2104

Conflicts:
  app/validators/dynamic_path_validator.rb

Fixed conflicts based on 3c7c859c359bf5d3955dd300d6861ff33af21ca7

1 files changed, 10 insertions, 0 deletions

diff --git a/spec/uploaders/file_uploader_spec.rb b/spec/uploaders/file_uploader_spec.rb
index d9113ef4095..47e9365e13d 100644
--- a/spec/uploaders/file_uploader_spec.rb
+++ b/spec/uploaders/file_uploader_spec.rb
@@ -15,6 +15,16 @@ describe FileUploader do
     end
   end
 
+  describe "#store_dir" do
+    it "stores in the namespace path" do
+      project = build_stubbed(:empty_project)
+      uploader = described_class.new(project)
+
+      expect(uploader.store_dir).to include(project.path_with_namespace)
+      expect(uploader.store_dir).not_to include("system")
+    end
+  end
+
   describe 'initialize' do
     it 'generates a secret if none is provided' do
       expect(SecureRandom).to receive(:hex).and_return('secret')