diff options
author | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-09-26 16:53:20 +0300 |
---|---|---|
committer | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-09-26 16:53:20 +0300 |
commit | 020df25cd84acd8baa1f61be8f32153a7928336b (patch) | |
tree | 9d34f8eb184827ea49115477d96c04b3118b265e /spec | |
parent | 42902b2fcba875241edca5ed5b24c6eb8108b4d0 (diff) | |
parent | f37b0cd625f858f7db5d0075b9487909f791b04a (diff) |
Merge branch 'security-12718-project-milestones-disclosed-via-groups-12-3-ce' into '12-3-stable'
Hide disabled project milestones in project settings on group level
See merge request gitlab/gitlabhq!3424
Diffstat (limited to 'spec')
-rw-r--r-- | spec/controllers/groups/milestones_controller_spec.rb | 71 | ||||
-rw-r--r-- | spec/requests/groups/milestones_controller_spec.rb | 32 |
2 files changed, 101 insertions, 2 deletions
diff --git a/spec/controllers/groups/milestones_controller_spec.rb b/spec/controllers/groups/milestones_controller_spec.rb index 41927907fd1..e0a3605d50a 100644 --- a/spec/controllers/groups/milestones_controller_spec.rb +++ b/spec/controllers/groups/milestones_controller_spec.rb @@ -3,8 +3,8 @@ require 'spec_helper' describe Groups::MilestonesController do - let(:group) { create(:group) } - let!(:project) { create(:project, group: group) } + let(:group) { create(:group, :public) } + let!(:project) { create(:project, :public, group: group) } let!(:project2) { create(:project, group: group) } let(:user) { create(:user) } let(:title) { '肯定不是中文的问题' } @@ -63,6 +63,73 @@ describe Groups::MilestonesController do expect(response.body).to include(group_milestone.title) expect(response.body).not_to include(milestone.title) end + + context 'when anonymous user' do + before do + sign_out(user) + end + + it 'shows group milestones page' do + milestone + + get :index, params: { group_id: group.to_param } + + expect(response).to have_gitlab_http_status(200) + expect(response.body).to include(milestone.title) + end + end + + context 'when issues and merge requests are disabled in public project' do + shared_examples 'milestone not accessible' do + it 'does not return milestone' do + get :index, params: { group_id: public_group.to_param } + + expect(response).to have_gitlab_http_status(200) + expect(response.body).not_to include(private_milestone.title) + end + end + + let!(:public_group) { create(:group, :public) } + + let!(:public_project_with_private_issues_and_mrs) do + create(:project, :public, :issues_private, :merge_requests_private, group: public_group) + end + let!(:private_milestone) { create(:milestone, project: public_project_with_private_issues_and_mrs, title: 'project milestone') } + + context 'when anonymous user' do + before do + sign_out(user) + end + + it_behaves_like 'milestone not accessible' + end + + context 'when non project or group member user' do + let(:non_member) { create(:user) } + + before do + sign_in(non_member) + end + + it_behaves_like 'milestone not accessible' + end + + context 'when group member user' do + let(:member) { create(:user) } + + before do + sign_in(member) + public_group.add_guest(member) + end + + it 'returns the milestone' do + get :index, params: { group_id: public_group.to_param } + + expect(response).to have_gitlab_http_status(200) + expect(response.body).to include(private_milestone.title) + end + end + end end context 'as JSON' do diff --git a/spec/requests/groups/milestones_controller_spec.rb b/spec/requests/groups/milestones_controller_spec.rb new file mode 100644 index 00000000000..af19d931284 --- /dev/null +++ b/spec/requests/groups/milestones_controller_spec.rb @@ -0,0 +1,32 @@ +require 'spec_helper' + +describe Groups::MilestonesController do + context 'N+1 DB queries' do + let(:user) { create(:user) } + let!(:public_group) { create(:group, :public) } + + let!(:public_project_with_private_issues_and_mrs) do + create(:project, :public, :issues_private, :merge_requests_private, group: public_group) + end + let!(:private_milestone) { create(:milestone, project: public_project_with_private_issues_and_mrs, title: 'project milestone') } + + it 'avoids N+1 database queries' do + public_project = create(:project, :public, :merge_requests_enabled, :issues_enabled, group: public_group) + create(:milestone, project: public_project) + + control_count = ActiveRecord::QueryRecorder.new(skip_cached: false) { get "/groups/#{public_group.to_param}/-/milestones.json" }.count + + projects = create_list(:project, 2, :public, :merge_requests_enabled, :issues_enabled, group: public_group) + projects.each do |project| + create(:milestone, project: project) + end + + expect { get "/groups/#{public_group.to_param}/-/milestones.json" }.not_to exceed_all_query_limit(control_count) + expect(response).to have_http_status(200) + milestones = json_response + + expect(milestones.count).to eq(3) + expect(milestones.map {|x| x['title']}).not_to include(private_milestone.title) + end + end +end |