Skip to content

Subgroup on MySQL can still be created in GitLab 9.3.9 and 9.4.2

Summary

Can create a subgroup with GitLab 9.3.9 and 9.4.2 when using MySQL but shouldn't be able to.

Steps to reproduce

  • Install and configure 9.3.9 or 9.4.2 (I don't think it is addressed in 9.4.3 looking at the release announcement so probably fails on that but not tested yet) to point to a MySQL database.
  • Create a normal group.
  • Navigate to the group's page.
  • Click on the + button on the main navigation bar on the top right and there is an option to create a subgroup.parent_group
  • Enter details for the subgroup and click on create group.create_subgroup
  • Group is created as a subgroup and not a top level group.

What is the current bug behavior?

The subgroup is created.

What is the expected correct behavior?

Shouldn't be able to create any subgroups when using MySQL after 9.3.

Possible fixes

I think there are a couple of places that this needs to be addressed. The first is to fix the navigation so that it doesn't show the subgroup option when using MySQL. This appears to be at https://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/views/layouts/header/_new_dropdown.haml#L13 where there is no check to see if subgroups are an enabled, just if the user can create them. This is handled at https://gitlab.com/gitlab-org/gitlab-ce/blob/master/app/views/groups/_show_nav.html.haml#L5 on the group page but not sure if that translates directly to the dropdown rendering.

The other place that should be fixed is that the new group page url, https://gitlab-install.com/groups/new?parent_id=29, is still allowing the parent_id to be specified on the query string, and possibly appears on the form as a hidden variable somewhere. The page should probably ignore the parameter if using MySQL and also ensure that even if a parent is supplied, or the form changed in some way, that when the group is created it will always be a top level group. When I was trying to work out how a user had created a subgroup I thought it might have been via the API but that does ignore the parent_id if you pass one.