Merge branch 'fix_internal_snippets_ee' into '7-4-stable-ee'

Fix internal snippets

See merge request !219

CHANGELOG

@@ -1,7 +1,11 @@
+v 7.4.2
+  - Fix internal snippet exposing for unauthenticated users
+
 v 7.4.1
   - Fix LDAP authentication for Git HTTP access
   - Fix LDAP config lookup for provider 'ldap'
   - Fix public snippets
+  - Fix 500 error on projects with nested submodules
 
 v 7.4.0
   - Refactored membership logic

VERSION

@@ -1 +1 @@
-7.4.1-ee
+7.4.2-ee

app/finders/snippets_finder.rb

@@ -29,6 +29,8 @@ class SnippetsFinder
   def by_user(current_user, user, scope)
     snippets = user.snippets.fresh.non_expired
 
+    return snippets.are_public unless current_user
+
     if user == current_user
       case scope
       when 'are_internal' then

spec/finders/snippets_finder_spec.rb

@@ -64,6 +64,13 @@ describe SnippetsFinder do
       snippets = SnippetsFinder.new.execute(user, filter: :by_user, user: user)
       snippets.should include(@snippet1, @snippet2, @snippet3)
     end
+
+    it "returns only public snippets if unauthenticated user" do
+      snippets = SnippetsFinder.new.execute(nil, filter: :by_user, user: user)
+      snippets.should include(@snippet3)
+      snippets.should_not include(@snippet2, @snippet1)
+    end
+
   end
 
   context 'by_project filter' do