GitLab steht wegen Wartungsarbeiten am Montag, den 10. Mai, zwischen 17:00 und 19:00 Uhr nicht zur Verfügung.

Commit 9c529aec authored by John Jarvis's avatar John Jarvis

Merge branch 'security-11-9-2826-fix-project-serialization-in-quick-actions' into '11-9-stable'

Fix project serialization in quick actions response

See merge request gitlab/gitlabhq!3015
parents 8436b72f df53080d
...@@ -48,7 +48,7 @@ def create ...@@ -48,7 +48,7 @@ def create
respond_to do |format| respond_to do |format|
format.json do format.json do
json = { json = {
commands_changes: @note.commands_changes commands_changes: @note.commands_changes&.slice(:emoji_award, :time_estimate, :spend_time)
} }
if @note.persisted? && return_discussion? if @note.persisted? && return_discussion?
title: Remove project serialization in quick actions response
type: security
...@@ -413,6 +413,37 @@ def post_create(extra_params = {}) ...@@ -413,6 +413,37 @@ def post_create(extra_params = {})
end end
end end
end end
context 'when creating a note with quick actions' do
context 'with commands that return changes' do
let(:note_text) { "/award :thumbsup:\n/estimate 1d\n/spend 3h" }
it 'includes changes in commands_changes ' do
post :create, params: request_params.merge(note: { note: note_text }, format: :json)
expect(response).to have_gitlab_http_status(200)
expect(json_response['commands_changes']).to include('emoji_award', 'time_estimate', 'spend_time')
expect(json_response['commands_changes']).not_to include('target_project', 'title')
context 'with commands that do not return changes' do
let(:issue) { create(:issue, project: project) }
let(:other_project) { create(:project) }
let(:note_text) { "/move #{other_project.full_path}\n/title AAA" }
before do
it 'does not include changes in commands_changes' do
post :create, params: request_params.merge(note: { note: note_text }, target_type: 'issue', target_id:, format: :json)
expect(response).to have_gitlab_http_status(200)
expect(json_response['commands_changes']).not_to include('target_project', 'title')
end end
describe 'PUT update' do describe 'PUT update' do
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment