diff options
author | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-09-26 16:53:25 +0300 |
---|---|---|
committer | GitLab Release Tools Bot <robert+release-tools@gitlab.com> | 2019-09-26 16:53:25 +0300 |
commit | 9c86027ec0556f59cef63cfe352cd30fafeaa13b (patch) | |
tree | 108079ab39d6a574d48602e18e9482cae4e75284 /spec | |
parent | f15977b0458bbb43964cdb476b00cde01b94260f (diff) | |
parent | d7cccb194162ef9f7881973bdfe9f1ebf24d880a (diff) |
Merge branch 'security-12717-fix-confidential-issue-assignee-visible-to-guests-12-3' into '12-3-stable'
Display only participants that user has permission to see
See merge request gitlab/gitlabhq!3421
Diffstat (limited to 'spec')
-rw-r--r-- | spec/controllers/projects/milestones_controller_spec.rb | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/spec/controllers/projects/milestones_controller_spec.rb b/spec/controllers/projects/milestones_controller_spec.rb index cbf9d437909..a3f55c1eed0 100644 --- a/spec/controllers/projects/milestones_controller_spec.rb +++ b/spec/controllers/projects/milestones_controller_spec.rb @@ -244,4 +244,45 @@ describe Projects::MilestonesController do end end end + + context '#participants' do + render_views + + context "when guest user" do + let(:issue_assignee) { create(:user) } + let(:guest_user) { create(:user) } + + before do + project.add_guest(guest_user) + sign_in(guest_user) + issue.update(assignee_ids: issue_assignee.id) + end + + context "when issue is not confidential" do + it 'shows milestone participants' do + params = { namespace_id: project.namespace.id, project_id: project.id, id: milestone.iid, format: :json } + get :participants, params: params + + expect(response).to have_gitlab_http_status(200) + expect(response.content_type).to eq 'application/json' + expect(json_response['html']).to include(issue_assignee.name) + end + end + + context "when issue is confidential" do + before do + issue.update(confidential: true) + end + + it 'shows no milestone participants' do + params = { namespace_id: project.namespace.id, project_id: project.id, id: milestone.iid, format: :json } + get :participants, params: params + + expect(response).to have_gitlab_http_status(200) + expect(response.content_type).to eq 'application/json' + expect(json_response['html']).not_to include(issue_assignee.name) + end + end + end + end end |