mirror of
https://github.com/wahyd4/gitlabhq.git
synced 2026-08-15 15:46:08 +10:00
Robert SpeicherandRobert Speicher
7917cbbb38
Fix an information disclosure when requesting access to a group containing private projects Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/19102. The commit speaks for itself: Fix an information disclosure when requesting access to a group containing private projects The issue was with the `User#groups` and `User#projects` associations which goes through the `User#group_members` and `User#project_members`. Initially I chose to use a secure approach by storing the requester's user ID in `Member#created_by_id` instead of `Member#user_id` because I was aware that there was a security risk since I didn't know the codebase well enough. Then during the review, we decided to change that and directly store the requester's user ID into `Member#user_id` (for the sake of simplifying the code I believe), meaning that every `group_members` / `project_members` association would include the requesters by default... My bad for not checking that all the `group_members` / `project_members` associations and the ones that go through them (e.g. `Group#users` and `Project#users`) were made safe with the `where(requested_at: nil)` / `where(members: { requested_at: nil })` scopes. Now they are all secure. See merge request !1973
21 lines
896 B
Plaintext
21 lines
896 B
Plaintext
- page_title "Groups", @user.name, "Users"
|
|
= render 'admin/users/head'
|
|
|
|
- group_members = @user.group_members.includes(:source)
|
|
- if group_members.any?
|
|
.panel.panel-default
|
|
.panel-heading Groups:
|
|
%ul.well-list
|
|
- group_members.each do |group_member|
|
|
- group = group_member.group
|
|
%li.group_member
|
|
%span{class: ("list-item-name" unless group_member.owner?)}
|
|
%strong= link_to group.name, admin_group_path(group)
|
|
.pull-right
|
|
%span.light= group_member.human_access
|
|
- unless group_member.owner?
|
|
= link_to group_group_member_path(group, group_member), data: { confirm: remove_member_message(group_member) }, method: :delete, remote: true, class: "btn-xs btn btn-remove", title: 'Remove user from group' do
|
|
%i.fa.fa-times.fa-inverse
|
|
- else
|
|
.nothing-here-block This user has no groups.
|