Commit f80f957f authored by GitLab Release Tools Bot's avatar GitLab Release Tools Bot

Merge branch 'security-issue_2830-11-9' into '11-9-stable'

Prevent leaking information when issue is moved

See merge request gitlab/gitlabhq!3073
parents 2243634b d73a0784
...@@ -15,7 +15,7 @@ ...@@ -15,7 +15,7 @@
.issuable-status-box.status-box.status-box-issue-closed{ class: issue_button_visibility(@issue, false) } .issuable-status-box.status-box.status-box-issue-closed{ class: issue_button_visibility(@issue, false) }
= sprite_icon('mobile-issue-close', size: 16, css_class: 'd-block d-sm-none') = sprite_icon('mobile-issue-close', size: 16, css_class: 'd-block d-sm-none')
.d-none.d-sm-block .d-none.d-sm-block
- if @issue.moved? - if @issue.moved? && can?(current_user, :read_issue, @issue.moved_to)
- moved_link_start = "<a href=\"#{issue_path(@issue.moved_to)}\" class=\"text-white text-underline\">".html_safe - moved_link_start = "<a href=\"#{issue_path(@issue.moved_to)}\" class=\"text-white text-underline\">".html_safe
- moved_link_end = '</a>'.html_safe - moved_link_end = '</a>'.html_safe
= s_('IssuableStatus|Closed (%{moved_link_start}moved%{moved_link_end})').html_safe % {moved_link_start: moved_link_start, = s_('IssuableStatus|Closed (%{moved_link_start}moved%{moved_link_end})').html_safe % {moved_link_start: moved_link_start,
......
---
title: 'Resolve: moving an issue to private repo leaks namespace and project name'
merge_request:
author:
type: security
...@@ -19,6 +19,7 @@ describe 'projects/issues/show' do ...@@ -19,6 +19,7 @@ describe 'projects/issues/show' do
context 'when the issue is closed' do context 'when the issue is closed' do
before do before do
allow(issue).to receive(:closed?).and_return(true) allow(issue).to receive(:closed?).and_return(true)
allow(view).to receive(:current_user).and_return(user)
end end
context 'when the issue was moved' do context 'when the issue was moved' do
...@@ -28,16 +29,30 @@ describe 'projects/issues/show' do ...@@ -28,16 +29,30 @@ describe 'projects/issues/show' do
issue.moved_to = new_issue issue.moved_to = new_issue
end end
it 'shows "Closed (moved)" if an issue has been moved' do context 'when user can see the moved issue' do
render before do
project.add_developer(user)
end
expect(rendered).to have_selector('.status-box-issue-closed:not(.hidden)', text: 'Closed (moved)') it 'shows "Closed (moved)" if an issue has been moved' do
render
expect(rendered).to have_selector('.status-box-issue-closed:not(.hidden)', text: 'Closed (moved)')
end
it 'links "moved" to the new issue the original issue was moved to' do
render
expect(rendered).to have_selector("a[href=\"#{issue_path(new_issue)}\"]", text: 'moved')
end
end end
it 'links "moved" to the new issue the original issue was moved to' do context 'when user cannot see moved issue' do
render it 'does not show moved issue link' do
render
expect(rendered).to have_selector("a[href=\"#{issue_path(new_issue)}\"]", text: 'moved') expect(rendered).not_to have_selector("a[href=\"#{issue_path(new_issue)}\"]", text: 'moved')
end
end end
end end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment