gitlabhq

mirror of https://github.com/wahyd4/gitlabhq.git synced 2026-08-10 05:06:46 +10:00

Files

T

Douwe Maan d1c94f034b Merge branch 'explicit-requesters-scope' into 'master'

Exclude requesters from Project#members, Group#members and User#members

## What does this MR do?

It excludes requesters from the `Project#members`, `Group#members` and `User#members` associations, and adds new `Project#requesters` and `Group#requesters` associations.

## Are there points in the code the reviewer needs to double check?

No.

## Why was this MR needed?

Without this, if you call `project.members`, requesters are included in the results! This is at best misleading, and at worst can lead to security issues. By excluding requesters from the `#members` associations, we avoid introducing security inadvertently since you have to call the `#requesters` association explicitly to get requesters.

## What are the relevant issue numbers?

This is something I realized while fixing the security issue #19102.

## Does this MR meet the acceptance criteria?

- [x] I don't think this needs a CHANGELOG since this is an internal change
- Tests
  - [x] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !4946

2016-07-01 22:23:26 +00:00

avatars_controller_spec.rb

Fix specs

2016-03-21 09:09:59 +01:00

blame_controller_spec.rb

Move a few controller specs to their correct locations

2016-02-18 21:50:49 -05:00

blob_controller_spec.rb

Validate presence of essential params for diff rendering

2016-06-24 16:20:53 -05:00

branches_controller_spec.rb

Enable Style/EmptyLines cop, remove redundant ones