From dbdeccdd96613180b11db82daf66d4e955e8537e Mon Sep 17 00:00:00 2001
From: Robert Speicher <robert@gitlab.com>
Date: Mon, 23 May 2016 00:41:50 +0000
Subject: [PATCH] Merge branch 'fix-access-to-pipelines-for-anonymous' into
 'master'

Allow anonymous user to access pipelines

## What does this MR do?

It fixes an issue where the Pipelines is shown for the Anonymous users,
but they get 404 when clicked. Their session is then logged out.

Fixes #17717.

See merge request !4233
---
 CHANGELOG                                | 1 +
 app/helpers/projects_helper.rb           | 4 ++++
 app/models/ability.rb                    | 1 +
 app/views/layouts/nav/_project.html.haml | 3 ++-
 spec/features/pipelines_spec.rb          | 6 ++++++
 5 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 2ec7dda118..6c5d343cf9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -2,6 +2,7 @@ Please view this file on the master branch, on stable branches it's out of date.
 
 v 8.8.1
   - Add documentation for the "Health Check" feature
+  - Allow anonymous users to access a public project's pipelines
   - Fix MySQL compatibility in zero downtime migrations helpers
   - Fix the CI login to Container Registry (the gitlab-ci-token user)
 
diff --git a/app/helpers/projects_helper.rb b/app/helpers/projects_helper.rb
index 0825b5b643..5e5d170a9f 100644
--- a/app/helpers/projects_helper.rb
+++ b/app/helpers/projects_helper.rb
@@ -144,6 +144,10 @@ module ProjectsHelper
       nav_tabs << :merge_requests
     end
 
+    if can?(current_user, :read_pipeline, project)
+      nav_tabs << :pipelines
+    end
+
     if can?(current_user, :read_build, project)
       nav_tabs << :builds
     end
diff --git a/app/models/ability.rb b/app/models/ability.rb
index f7ea2fd2b1..b354b1990c 100644
--- a/app/models/ability.rb
+++ b/app/models/ability.rb
@@ -60,6 +60,7 @@ class Ability
           :read_project_member,
           :read_merge_request,
           :read_note,
+          :read_pipeline,
           :read_commit_status,
           :read_container_image,
           :download_code
diff --git a/app/views/layouts/nav/_project.html.haml b/app/views/layouts/nav/_project.html.haml
index a97fefcfb4..6dff488eda 100644
--- a/app/views/layouts/nav/_project.html.haml
+++ b/app/views/layouts/nav/_project.html.haml
@@ -38,7 +38,7 @@
         %span
           Commits
 
-  - if project_nav_tab? :builds
+  - if project_nav_tab? :pipelines
     = nav_link(controller: :pipelines) do
       = link_to project_pipelines_path(@project), title: 'Pipelines', class: 'shortcuts-pipelines' do
         = icon('ship fw')
@@ -46,6 +46,7 @@
           Pipelines
           %span.count.ci_counter= number_with_delimiter(@project.ci_commits.running_or_pending.count)
 
+  - if project_nav_tab? :builds
     = nav_link(controller: %w(builds)) do
       = link_to project_builds_path(@project), title: 'Builds', class: 'shortcuts-builds' do
         = icon('cubes fw')
diff --git a/spec/features/pipelines_spec.rb b/spec/features/pipelines_spec.rb
index 32665aadd2..1d6f4485c8 100644
--- a/spec/features/pipelines_spec.rb
+++ b/spec/features/pipelines_spec.rb
@@ -24,6 +24,12 @@ describe "Pipelines" do
       end
     end
 
+    context 'anonymous access' do
+      before { visit namespace_project_pipelines_path(project.namespace, project) }
+
+      it { expect(page).to have_http_status(:success) }
+    end
+
     context 'cancelable pipeline' do
       let!(:running) { create(:ci_build, :running, commit: pipeline, stage: 'test', commands: 'test') }