From dcba5279b6e4bda905f5fa37a557b94f1fd42ba9 Mon Sep 17 00:00:00 2001 From: Stan Hu Date: Wed, 12 Jun 2019 16:03:46 -0700 Subject: Fix inability to set visibility_level on project via API Consider the scenario: 1. The default visibility level is set to internal 2. A user attempts to create a private project within a private group Previously this would always fail because default_value_for would overwrite the private visibility setting, no matter what visibility_level were specified. This was happening because default_value_for was confused by the default value of 0 specified by the database schema. default_value_for attempts to assign the default value in the block by checking whether the attribute has changed. The problem is that since the default value by the database was 0, and the user requested 0, this appeared as though no changes were made. As a result, default_value_for would always overwrite the user's preference. To fix this, we remove the use of default_value_for and only set the visibility level to the default application setting when no preference has been given at creation time. Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/63158 --- app/models/project.rb | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) (limited to 'app') diff --git a/app/models/project.rb b/app/models/project.rb index 9d17d68eee2..fb06af8e97e 100644 --- a/app/models/project.rb +++ b/app/models/project.rb @@ -72,7 +72,6 @@ class Project < ApplicationRecord delegate :no_import?, to: :import_state, allow_nil: true default_value_for :archived, false - default_value_for(:visibility_level) { Gitlab::CurrentSettings.default_project_visibility } default_value_for :resolve_outdated_diff_discussions, false default_value_for :container_registry_enabled, gitlab_config_features.container_registry default_value_for(:repository_storage) { Gitlab::CurrentSettings.pick_repository_storage } @@ -613,6 +612,23 @@ class Project < ApplicationRecord end end + def initialize(attributes = {}) + # We can't use default_value_for because the database has a default + # value of 0 for visibility_level. If someone attempts to create a + # private project, default_value_for will assume that the + # visibility_level hasn't changed and will use the application + # setting default, which could be internal or public. For projects + # inside a private group, those levels are invalid. + # + # To fix the problem, we assign the actual default in the application if + # no explicit visibility has been initialized. + unless visibility_attribute_present?(attributes) + attributes[:visibility_level] = Gitlab::CurrentSettings.default_project_visibility + end + + super + end + def all_pipelines if builds_enabled? super -- cgit v1.2.3