Skip to content
Snippets Groups Projects
Commit 72afcbcd authored by Douwe Maan's avatar Douwe Maan
Browse files

Always allow references to the current project

parent f42cfa9e
No related branches found
No related tags found
1 merge request!1090Separate rendering of Markdown reference links from redacting those the user doesn't have access to and extracting referenced objects
Pipeline #
Loading
@@ -61,7 +61,6 @@ module Mentionable
Loading
@@ -61,7 +61,6 @@ module Mentionable
   
ext = Gitlab::ReferenceExtractor.new(p, current_user) ext = Gitlab::ReferenceExtractor.new(p, current_user)
ext.analyze(text) ext.analyze(text)
(ext.issues + ext.merge_requests + ext.commits).uniq - [local_reference] (ext.issues + ext.merge_requests + ext.commits).uniq - [local_reference]
end end
   
Loading
Loading
Loading
@@ -26,7 +26,7 @@ module Gitlab
Loading
@@ -26,7 +26,7 @@ module Gitlab
reference_type = node.attr('data-reference-filter') reference_type = node.attr('data-reference-filter')
reference_filter = reference_type.constantize reference_filter = reference_type.constantize
   
reference_filter.user_can_reference?(current_user, node) reference_filter.user_can_reference?(current_user, node, context)
else else
true true
end end
Loading
Loading
Loading
@@ -15,9 +15,12 @@ module Gitlab
Loading
@@ -15,9 +15,12 @@ module Gitlab
# Results: # Results:
# :references - A Hash of references that were found and replaced. # :references - A Hash of references that were found and replaced.
class ReferenceFilter < HTML::Pipeline::Filter class ReferenceFilter < HTML::Pipeline::Filter
def self.user_can_reference?(user, node) def self.user_can_reference?(user, node, context)
if node.has_attribute?('data-project') if node.has_attribute?('data-project')
project = Project.find(node.attr('data-project')) rescue nil project_id = node.attr('data-project').to_i
return true if project_id == context[:project].id
project = Project.find(project_id) rescue nil
Ability.abilities.allowed?(user, :read_project, project) Ability.abilities.allowed?(user, :read_project, project)
else else
true true
Loading
Loading
Loading
@@ -31,7 +31,7 @@ module Gitlab
Loading
@@ -31,7 +31,7 @@ module Gitlab
reference_type = node.attr('data-reference-filter') reference_type = node.attr('data-reference-filter')
reference_filter = reference_type.constantize reference_filter = reference_type.constantize
   
return unless reference_filter.user_can_reference?(current_user, node) return unless reference_filter.user_can_reference?(current_user, node, context)
   
references = reference_filter.referenced_by(node) references = reference_filter.referenced_by(node)
return unless references return unless references
Loading
Loading
Loading
@@ -42,7 +42,7 @@ module Gitlab
Loading
@@ -42,7 +42,7 @@ module Gitlab
end end
end end
   
def self.user_can_reference?(user, node) def self.user_can_reference?(user, node, context)
if node.has_attribute?('data-group') if node.has_attribute?('data-group')
group = Group.find(node.attr('data-group')) rescue nil group = Group.find(node.attr('data-group')) rescue nil
Ability.abilities.allowed?(user, :read_group, group) Ability.abilities.allowed?(user, :read_group, group)
Loading
Loading
Loading
@@ -2,7 +2,7 @@ require 'spec_helper'
Loading
@@ -2,7 +2,7 @@ require 'spec_helper'
   
describe Gitlab::ReferenceExtractor do describe Gitlab::ReferenceExtractor do
let(:project) { create(:project) } let(:project) { create(:project) }
subject { Gitlab::ReferenceExtractor.new(project, project.owner) } subject { Gitlab::ReferenceExtractor.new(project, project.creator) }
   
it 'accesses valid user objects' do it 'accesses valid user objects' do
@u_foo = create(:user, username: 'foo') @u_foo = create(:user, username: 'foo')
Loading
@@ -102,7 +102,7 @@ describe Gitlab::ReferenceExtractor do
Loading
@@ -102,7 +102,7 @@ describe Gitlab::ReferenceExtractor do
let(:issue) { create(:issue, project: other_project) } let(:issue) { create(:issue, project: other_project) }
   
before do before do
other_project.team << [project.owner, :developer] other_project.team << [project.creator, :developer]
end end
   
it 'handles project issue references' do it 'handles project issue references' do
Loading
Loading
Loading
@@ -50,6 +50,8 @@ def common_mentionable_setup
Loading
@@ -50,6 +50,8 @@ def common_mentionable_setup
} }
extra_commits.each { |c| commitmap[c.short_id] = c } extra_commits.each { |c| commitmap[c.short_id] = c }
   
allow(Project).to receive(:find).and_call_original
allow(Project).to receive(:find).with(project.id.to_s).and_return(project)
allow(project.repository).to receive(:commit) { |sha| commitmap[sha] } allow(project.repository).to receive(:commit) { |sha| commitmap[sha] }
   
set_mentionable_text.call(ref_string) set_mentionable_text.call(ref_string)
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment