mirror of
https://github.com/wahyd4/gitlabhq.git
synced 2026-08-11 13:46:11 +10:00
Rémy Coutable
aec3475df9
The issue was with the `User#groups` and `User#projects` associations
which goes through the `User#group_members` and `User#project_members`.
Initially I chose to use a secure approach by storing the requester's
user ID in `Member#created_by_id` instead of `Member#user_id` because I
was aware that there was a security risk since I didn't know the
codebase well enough.
Then during the review, we decided to change that and directly store the
requester's user ID into `Member#user_id` (for the sake of simplifying
the code I believe), meaning that every `group_members` / `project_members`
association would include the requesters by default...
My bad for not checking that all the `group_members` / `project_members`
associations and the ones that go through them (e.g. `Group#users` and
`Project#users`) were made safe with the `where(requested_at: nil)` /
`where(members: { requested_at: nil })` scopes.
Now they are all secure.
Signed-off-by: Rémy Coutable <remy@rymai.me>
21 lines
896 B
Plaintext
21 lines
896 B
Plaintext
- page_title "Groups", @user.name, "Users"
|
|
= render 'admin/users/head'
|
|
|
|
- group_members = @user.group_members.includes(:source)
|
|
- if group_members.any?
|
|
.panel.panel-default
|
|
.panel-heading Groups:
|
|
%ul.well-list
|
|
- group_members.each do |group_member|
|
|
- group = group_member.group
|
|
%li.group_member
|
|
%span{class: ("list-item-name" unless group_member.owner?)}
|
|
%strong= link_to group.name, admin_group_path(group)
|
|
.pull-right
|
|
%span.light= group_member.human_access
|
|
- unless group_member.owner?
|
|
= link_to group_group_member_path(group, group_member), data: { confirm: remove_member_message(group_member) }, method: :delete, remote: true, class: "btn-xs btn btn-remove", title: 'Remove user from group' do
|
|
%i.fa.fa-times.fa-inverse
|
|
- else
|
|
.nothing-here-block This user has no groups.
|