Welcome to mirror list, hosted at ThFree Co, Russian Federation.

gitlab.com/gitlab-org/gitlab-foss.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/spec/lib/gitlab/project_search_results_spec.rb
AgeCommit message (Collapse)Author
2018-03-19Split repository search result on \n instead of $ to prevent the items of ↵Jasper Maes
the array to start with a newline. Remove the strip from parsing the search result to keep result endlines.
2018-03-12Fix code and wiki search results when filename is non-ASCIISean McGivern
Previously, we only handled non-ASCII file contents, but the name itself can be non-ASCII.
2018-03-05Use limited count queries also for scoped searchesJan Provaznik
2018-02-28Fix code search results with non-ASCII dataSean McGivern
Gitlab::Git::Popen#popen now returns ASCII-8BIT (binary) data always, so we need to handle that explicitly.
2018-01-16Fix project search results for digits surrounded by colonsSean McGivern
A file containing /:\d+:/ in its contents would break the search results if those contents were part of the results, because we were splitting on colons, which can't work with untrusted input. Changing to use the null byte as a separator is much safer.
2017-12-22Replace '.team << [user, role]' with 'add_role(user)' in specsblackst0ne
2017-11-30fix for special charecter in file nameshaseeb
2017-08-03Change all `:empty_project` to `:project`Robert Speicher
2017-08-01Ensure all project factories use `:repository` trait or `:empty_project`Robert Speicher
2017-07-27Remove superfluous lib: true, type: redis, service: true, models: true, ↵Rémy Coutable
services: true, no_db: true, api: true Signed-off-by: Rémy Coutable <remy@rymai.me>
2017-05-29Explicitly test that guest is able to search through the wikiValery Sizov
2017-05-12Backport FileFinder from EEValery Sizov
2017-05-10Merge branch '31157-respect-project-features-in-wiki-search' into 'security' Douwe Maan
Respect project features in wiki and blob search See merge request !2089
2017-05-04Backport of multiple_assignees_feature [ci skip]Valery Sizov
2017-04-03Fix blob highlighting in searchNick Thomas
2017-02-05Add traits for ProjectFeatures to Project factorySemyon Pupkov
https://gitlab.com/gitlab-org/gitlab-ce/issues/24007
2017-01-25Use `:empty_project` where possible throughout spec/libRobert Speicher
2017-01-24Allows to search within project by commit's hashYarNayar
Was proposed in #24833
2016-12-15Merge branch 'jej-note-search-uses-finder' into 'security' Douwe Maan
Fix missing Note access checks in by moving Note#search to updated NoteFinder Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867 ## Which fixes are in this MR? :warning: - Potentially untested :bomb: - No test coverage :traffic_light: - Test coverage of some sort exists (a test failed when error raised) :vertical_traffic_light: - Test coverage of return value (a test failed when nil used) :white_check_mark: - Permissions check tested ### Note lookup without access check - [x] :white_check_mark: app/finders/notes_finder.rb:13 :download_code check - [x] :white_check_mark: app/finders/notes_finder.rb:19 `SnippetsFinder` - [x] :white_check_mark: app/models/note.rb:121 [`Issue#visible_to_user`] - [x] :white_check_mark: lib/gitlab/project_search_results.rb:113 - This is the only use of `app/models/note.rb:121` above, but importantly has no access checks at all. This means it leaks MR comments and snippets when those features are `team-only` in addition to the issue comments which would be fixed by `app/models/note.rb:121`. - It is only called from SearchController where `can?(current_user, :download_code, @project)` is checked, so commit comments are not leaked. ### Previous discussions - [x] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b915c5267a63628b0bafd23d37792ae73ceae272_13_13 `: download_code` check on commit - [x] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b915c5267a63628b0bafd23d37792ae73ceae272_19_19 `SnippetsFinder` should be used - `SnippetsFinder` should check if the snippets feature is enabled -> https://gitlab.com/gitlab-org/gitlab-ce/issues/25223 ### Acceptance criteria met? - [x] Tests added for new code - [x] TODO comments removed - [x] Squashed and removed skipped tests - [x] Changelog entry - [ ] State Gitlab versions affected and issue severity in description - [ ] Create technical debt issue for NotesFinder. - Either split into `NotesFinder::ForTarget` and `NotesFinder::Search` or consider object per notable type such as `NotesFinder::OnIssue`. For the first option could create `NotesFinder::Base` which is either inherited from or which can be included in the other two. - Avoid case statement anti-pattern in this finder with use of `NotesFinder::OnCommit` etc. Consider something on the finder for this? `Model.finder(user, project)` - Move `inc_author` to the controller, and implement `related_notes` to replace `non_diff_notes`/`mr_and_commit_notes` See merge request !2035
2016-11-29Merge branch 'jej-use-issuable-finder-instead-of-access-check' into 'security' Douwe Maan
Replace issue access checks with use of IssuableFinder Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867 ## Which fixes are in this MR? :warning: - Potentially untested :bomb: - No test coverage :traffic_light: - Test coverage of some sort exists (a test failed when error raised) :vertical_traffic_light: - Test coverage of return value (a test failed when nil used) :white_check_mark: - Permissions check tested ### Issue lookup with access check Using `visible_to_user` likely makes these security issues too. See [Code smells](#code-smells). - [x] :vertical_traffic_light: app/finders/notes_finder.rb:15 [`visible_to_user`] - [x] :traffic_light: app/views/layouts/nav/_project.html.haml:73 [`visible_to_user`] [`.count`] - [x] :white_check_mark: app/services/merge_requests/build_service.rb:84 [`issue.try(:confidential?)`] - [x] :white_check_mark: lib/api/issues.rb:112 [`visible_to_user`] - CHANGELOG: Prevented API returning issues set to 'Only team members' to everyone - [x] :white_check_mark: lib/api/helpers.rb:126 [`can?(current_user, :read_issue, issue)`] Maybe here too? - [x] :white_check_mark: lib/gitlab/search_results.rb:53 [`visible_to_user`] ### Previous discussions - [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b2ff264eddf9819d7693c14ae213d941494fe2b3_128_126 - [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#7b6375270d22f880bdcb085e47b519b426a5c6c7_87_87 See merge request !2031
2016-11-16Search for a filename in a projectValery Sizov
2016-08-09adds second batch of tests changed to active tensetiagonbotelho
2016-06-14Project members with guest role can't access confidential issuesDouglas Barbosa Alexandre
2016-03-18Restrict access to confidential issues on search resultsDouglas Barbosa Alexandre
2016-03-11Fixed ProjectSearchResults spec to use a ProjectYorick Peterse
This spec was still passing an ID to the #initialize method instead of a Project instance.
2015-12-09Tag lib specsDouwe Maan
2015-10-21Fix issue #3055 (project search with unmatched parentheses)Dirceu Pereira Tiegs
2015-06-18Add init test for ProjectSearchResultsStan Hu
See: https://github.com/gitlabhq/gitlabhq/pull/9368#issuecomment-110350335
    generated by cgit v1.2.3 (git 2.25.1) at 2024-08-27 16:27:44 +0300