Files
gitlabhq/app/controllers/projects/commit_controller.rb
Kamil Trzcinski 447f1e30db Limit guest access builds
This solves https://dev.gitlab.org/gitlab/gitlabhq/issues/2646

1. This MR simplifies CI permission model:
    - read_build: allows to read a list of builds, artifacts and trace
    - update_build: allows to cancel and retry builds
    - admin_build: allows to manage triggers, runners and variables
    - read_commit_status: allows to read a list of commit statuses (including the status of a build, but doesn't allow to see a build details)
    - create_commit_status: allows to create a new commit status using API

2. I do make sure that the proper permissions are used in all places where the CI can be shown.

3. Add the `read_build` ability if user is anonymous or guest and allow_guest_to_access_builds is enabled.

4. Add CI setting: public_builds.

5. The artifacts specific permission are removed, since they are covered by `*_build`.
2016-02-08 20:27:24 +01:00

81 lines
2.1 KiB
Ruby

# Controller for a specific Commit
#
# Not to be confused with CommitsController, plural.
class Projects::CommitController < Projects::ApplicationController
# Authorize
before_action :require_non_empty_project
before_action :authorize_download_code!, except: [:cancel_builds, :retry_builds]
before_action :authorize_update_build!, only: [:cancel_builds, :retry_builds]
before_action :authorize_read_commit_status!, only: [:builds]
before_action :commit
before_action :define_show_vars, only: [:show, :builds]
def show
return git_not_found! unless @commit
@line_notes = commit.notes.inline
@note = @project.build_commit_note(commit)
@notes = commit.notes.not_inline.fresh
@noteable = @commit
@comments_allowed = @reply_allowed = true
@comments_target = {
noteable_type: 'Commit',
commit_id: @commit.id
}
respond_to do |format|
format.html
format.diff { render text: @commit.to_diff }
format.patch { render text: @commit.to_patch }
end
end
def builds
end
def cancel_builds
ci_commit.builds.running_or_pending.each(&:cancel)
redirect_back_or_default default: builds_namespace_project_commit_path(project.namespace, project, commit.sha)
end
def retry_builds
ci_commit.builds.latest.failed.each do |build|
if build.retryable?
Ci::Build.retry(build)
end
end
redirect_back_or_default default: builds_namespace_project_commit_path(project.namespace, project, commit.sha)
end
def branches
@branches = @project.repository.branch_names_contains(commit.id)
@tags = @project.repository.tag_names_contains(commit.id)
render layout: false
end
private
def commit
@commit ||= @project.commit(params[:id])
end
def ci_commit
@ci_commit ||= project.ci_commit(commit.sha)
end
def define_show_vars
if params[:w].to_i == 1
@diffs = commit.diffs({ ignore_whitespace_change: true })
else
@diffs = commit.diffs
end
@diff_refs = [commit.parent || commit, commit]
@notes_count = commit.notes.count
@statuses = ci_commit.statuses if ci_commit
end
end