deac/gitlabhq
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fix security issues with teams

Browse source
This commit is contained in:
Dmitriy Zaporozhets 2013-01-25 15:51:45 +02:00
parent 3ddd9f753c
commit 6350b32a3d
4 changed files with 16 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
app/controllers/dashboard_controller.rb
View file

@ -18,7 +18,7 @@ class DashboardController < ApplicationController
@projects @projects
end end
@teams = (UserTeam.with_member(current_user) + UserTeam.created_by(current_user)).uniq @teams = current_user.authorized_teams
@projects = @projects.page(params[:page]).per(30) @projects = @projects.page(params[:page]).per(30)

9
app/controllers/teams_controller.rb
View file

@ -4,11 +4,9 @@ class TeamsController < ApplicationController
before_filter :authorize_manage_user_team!, only: [:edit, :update] before_filter :authorize_manage_user_team!, only: [:edit, :update]
before_filter :authorize_admin_user_team!, only: [:destroy] before_filter :authorize_admin_user_team!, only: [:destroy]
layout 'user_team', except: [:new, :create] before_filter :user_team, except: [:new, :create]
def index layout 'user_team', except: [:new, :create]
@teams = current_user.user_teams.order('name ASC')
end
def show def show
user_team user_team
@ -83,7 +81,6 @@ class TeamsController < ApplicationController
end end
def user_team def user_team
@team ||= UserTeam.find_by_path(params[:id]) @team ||= current_user.authorized_teams.find_by_path(params[:id])
end end
end end

1
app/helpers/application_helper.rb
View file

@ -74,6 +74,7 @@ module ApplicationHelper
def search_autocomplete_source def search_autocomplete_source
projects = current_user.authorized_projects.map { |p| { label: "project: #{p.name_with_namespace}", url: project_path(p) } } projects = current_user.authorized_projects.map { |p| { label: "project: #{p.name_with_namespace}", url: project_path(p) } }
groups = current_user.authorized_groups.map { |group| { label: "group: #{group.name}", url: group_path(group) } } groups = current_user.authorized_groups.map { |group| { label: "group: #{group.name}", url: group_path(group) } }
teams = current_user.authorized_teams.map { |team| { label: "team: #{team.name}", url: team_path(team) } }
default_nav = [ default_nav = [
{ label: "My Profile", url: profile_path }, { label: "My Profile", url: profile_path },

11
app/models/user.rb
View file

@ -295,4 +295,15 @@ class User < ActiveRecord::Base
def namespace_id def namespace_id
namespace.try :id namespace.try :id
end end
def authorized_teams
@authorized_teams ||= begin
ids = []
ids << UserTeam.with_member(self).pluck('user_teams.id')
ids << UserTeam.created_by(self).pluck('user_teams.id')
ids.flatten
UserTeam.where(id: ids)
end
end
end end