The issue was with the `User#groups` and `User#projects` associations
which goes through the `User#group_members` and `User#project_members`.
Initially I chose to use a secure approach by storing the requester's
user ID in `Member#created_by_id` instead of `Member#user_id` because I
was aware that there was a security risk since I didn't know the
codebase well enough.
Then during the review, we decided to change that and directly store the
requester's user ID into `Member#user_id` (for the sake of simplifying
the code I believe), meaning that every `group_members` / `project_members`
association would include the requesters by default...
My bad for not checking that all the `group_members` / `project_members`
associations and the ones that go through them (e.g. `Group#users` and
`Project#users`) were made safe with the `where(requested_at: nil)` /
`where(members: { requested_at: nil })` scopes.
Now they are all secure.
Signed-off-by: Rémy Coutable <remy@rymai.me>
- Some views had a "Close" button. We've removed this, because we don't
want users accidentally hiding the validation errors and not knowing
what needs to be fixed.
- Some views used `li`, some used `p`, some used `span`. We've
standardized on `li`.
- Some views only showed the first error. We've standardized on showing
all of them.
- Some views added an `#error_explanation` div, which we've made
standard.
LDAP Sync blocked user edgecases
Allow GitLab admins to block otherwise valid GitLab LDAP users
(https://gitlab.com/gitlab-org/gitlab-ce/issues/3462)
Based on the discussion on the original issue, we are going to differentiate "normal" block operations to the ldap automatic ones in order to make some decisions when its one or the other.
Expected behavior:
- [x] "ldap_blocked" users respond to both `blocked?` and `ldap_blocked?`
- [x] "ldap_blocked" users can't be unblocked by the Admin UI
- [x] "ldap_blocked" users can't be unblocked by the API
- [x] Block operations that are originated from LDAP synchronization will flag user as "ldap_blocked"
- [x] Only "ldap_blocked" users will be automatically unblocked by LDAP synchronization
- [x] When LDAP identity is removed, we should convert `ldap_blocked` into `blocked`
Mockup for the Admin UI with both "ldap_blocked" and normal "blocked" users:
There will be another MR for the EE version.
See merge request !2242
Improve admin area button style
A lot of the buttons in the top right in the admin area were too big. This makes those the new `btn-nr` size which seems to look nice.
## User buttons
### Current
### New
## Project edit button
### Current
### New 
## Label button
### Current
### New
cc/ @jschatz1 @creamzy @skyruler
See merge request !2351
Modifies the existing "login as" feature to be called impersonation, as
well as keeping track of who is impersonating to revert back to that
user without having to log out.
Andrey Krivko
Robert Speicher
Alfredo Sumaran
Valery Sizov
Rémy Coutable
Annabel Dunstone
Arinde EniolaandJacob Schatz
Zeger-Jan van de Weg
Phil Hughes
Dmitriy Zaporozhets
Douwe Maan
Gabriel Mazetto
Jacob Schatz
Stan Hu
Drew Blessing
Andrew Tomaka
Alex Jordan
James Newton
Yorick Peterse
Valery Sizov
Jerry LukinsandJerry Lukins
Pavel Forkert
Hannes Rosenögger