Merge branch '47672-set_inline_content_type_for_ics' into 'master'

Render calendar feed inline when accessed from GitLab

Closes #47672

See merge request gitlab-org/gitlab-ce!19698

7 files changed, 87 insertions, 42 deletions

diff --git a/app/controllers/concerns/issues_action.rb b/app/controllers/concerns/issues_action.rb
index b6eb7d292fc..9d58656773d 100644
--- a/app/controllers/concerns/issues_action.rb
+++ b/app/controllers/concerns/issues_action.rb
@@ -1,6 +1,7 @@
 module IssuesAction
   extend ActiveSupport::Concern
   include IssuableCollections
+  include IssuesCalendar
 
   # rubocop:disable Gitlab/ModuleWithInstanceVariables
   def issues
@@ -17,18 +18,9 @@ module IssuesAction
   end
   # rubocop:enable Gitlab/ModuleWithInstanceVariables
 
-  # rubocop:disable Gitlab/ModuleWithInstanceVariables
   def issues_calendar
-    @issues = issuables_collection
-                  .non_archived
-                  .with_due_date
-                  .limit(100)
-
-    respond_to do |format|
-      format.ics { response.headers['Content-Disposition'] = 'inline' }
-    end
+    render_issues_calendar(issuables_collection)
   end
-  # rubocop:enable Gitlab/ModuleWithInstanceVariables
 
   private
 
diff --git a/app/controllers/concerns/issues_calendar.rb b/app/controllers/concerns/issues_calendar.rb
new file mode 100644
index 00000000000..671a204621d
--- /dev/null
+++ b/app/controllers/concerns/issues_calendar.rb
@@ -0,0 +1,24 @@
+module IssuesCalendar
+  extend ActiveSupport::Concern
+
+  # rubocop:disable Gitlab/ModuleWithInstanceVariables
+  def render_issues_calendar(issuables)
+    @issues = issuables
+                  .non_archived
+                  .with_due_date
+                  .limit(100)
+
+    respond_to do |format|
+      format.ics do
+        # NOTE: with text/calendar as Content-Type, the browser always downloads
+        #       the content as a file (even ignoring the Content-Disposition
+        #       header). We want to display the content inline when accessed
+        #       from GitLab, similarly to the RSS feed.
+        if request.referer&.start_with?(::Settings.gitlab.base_url)
+          response.headers['Content-Type'] = 'text/plain'
+        end
+      end
+    end
+  end
+  # rubocop:enable Gitlab/ModuleWithInstanceVariables
+end
diff --git a/app/controllers/projects/issues_controller.rb b/app/controllers/projects/issues_controller.rb
index 35c36c725e2..7c897b2d86c 100644
--- a/app/controllers/projects/issues_controller.rb
+++ b/app/controllers/projects/issues_controller.rb
@@ -4,6 +4,7 @@ class Projects::IssuesController < Projects::ApplicationController
   include IssuableActions
   include ToggleAwardEmoji
   include IssuableCollections
+  include IssuesCalendar
   include SpammableActions
 
   prepend_before_action :authenticate_user!, only: [:new]
@@ -40,14 +41,7 @@ class Projects::IssuesController < Projects::ApplicationController
   end
 
   def calendar
-    @issues = @issuables
-                  .non_archived
-                  .with_due_date
-                  .limit(100)
-
-    respond_to do |format|
-      format.ics { response.headers['Content-Disposition'] = 'inline' }
-    end
+    render_issues_calendar(@issuables)
   end
 
   def new
diff --git a/changelogs/unreleased/47672-set_inline_content_type_for_ics.yml b/changelogs/unreleased/47672-set_inline_content_type_for_ics.yml
new file mode 100644
index 00000000000..4bc883d41bd
--- /dev/null
+++ b/changelogs/unreleased/47672-set_inline_content_type_for_ics.yml
@@ -0,0 +1,5 @@
+---
+title: Render calendar feed inline when accessed from GitLab
+merge_request:
+author:
+type: fixed
diff --git a/spec/features/ics/dashboard_issues_spec.rb b/spec/features/ics/dashboard_issues_spec.rb
index 5d6cd44ad1c..90d02f7e40f 100644
--- a/spec/features/ics/dashboard_issues_spec.rb
+++ b/spec/features/ics/dashboard_issues_spec.rb
@@ -11,13 +11,25 @@ describe 'Dashboard Issues Calendar Feed'  do
     end
 
     context 'when authenticated' do
-      it 'renders calendar feed' do
-        sign_in user
-        visit issues_dashboard_path(:ics)
+      context 'with no referer' do
+        it 'renders calendar feed' do
+          sign_in user
+          visit issues_dashboard_path(:ics)
 
-        expect(response_headers['Content-Type']).to have_content('text/calendar')
-        expect(response_headers['Content-Disposition']).to have_content('inline')
-        expect(body).to have_text('BEGIN:VCALENDAR')
+          expect(response_headers['Content-Type']).to have_content('text/calendar')
+          expect(body).to have_text('BEGIN:VCALENDAR')
+        end
+      end
+
+      context 'with GitLab as the referer' do
+        it 'renders calendar feed as text/plain' do
+          sign_in user
+          page.driver.header('Referer', issues_dashboard_url(host: Settings.gitlab.base_url))
+          visit issues_dashboard_path(:ics)
+
+          expect(response_headers['Content-Type']).to have_content('text/plain')
+          expect(body).to have_text('BEGIN:VCALENDAR')
+        end
       end
     end
 
@@ -28,7 +40,6 @@ describe 'Dashboard Issues Calendar Feed'  do
         visit issues_dashboard_path(:ics, private_token: personal_access_token.token)
 
         expect(response_headers['Content-Type']).to have_content('text/calendar')
-        expect(response_headers['Content-Disposition']).to have_content('inline')
         expect(body).to have_text('BEGIN:VCALENDAR')
       end
     end
@@ -38,7 +49,6 @@ describe 'Dashboard Issues Calendar Feed'  do
         visit issues_dashboard_path(:ics, feed_token: user.feed_token)
 
         expect(response_headers['Content-Type']).to have_content('text/calendar')
-        expect(response_headers['Content-Disposition']).to have_content('inline')
         expect(body).to have_text('BEGIN:VCALENDAR')
       end
     end
diff --git a/spec/features/ics/group_issues_spec.rb b/spec/features/ics/group_issues_spec.rb
index 0a049be2ffe..24de5b4b7c6 100644
--- a/spec/features/ics/group_issues_spec.rb
+++ b/spec/features/ics/group_issues_spec.rb
@@ -13,13 +13,25 @@ describe 'Group Issues Calendar Feed'  do
     end
 
     context 'when authenticated' do
-      it 'renders calendar feed' do
-        sign_in user
-        visit issues_group_path(group, :ics)
+      context 'with no referer' do
+        it 'renders calendar feed' do
+          sign_in user
+          visit issues_group_path(group, :ics)
 
-        expect(response_headers['Content-Type']).to have_content('text/calendar')
-        expect(response_headers['Content-Disposition']).to have_content('inline')
-        expect(body).to have_text('BEGIN:VCALENDAR')
+          expect(response_headers['Content-Type']).to have_content('text/calendar')
+          expect(body).to have_text('BEGIN:VCALENDAR')
+        end
+      end
+
+      context 'with GitLab as the referer' do
+        it 'renders calendar feed as text/plain' do
+          sign_in user
+          page.driver.header('Referer', issues_group_url(group, host: Settings.gitlab.base_url))
+          visit issues_group_path(group, :ics)
+
+          expect(response_headers['Content-Type']).to have_content('text/plain')
+          expect(body).to have_text('BEGIN:VCALENDAR')
+        end
       end
     end
 
@@ -30,7 +42,6 @@ describe 'Group Issues Calendar Feed'  do
         visit issues_group_path(group, :ics, private_token: personal_access_token.token)
 
         expect(response_headers['Content-Type']).to have_content('text/calendar')
-        expect(response_headers['Content-Disposition']).to have_content('inline')
         expect(body).to have_text('BEGIN:VCALENDAR')
       end
     end
@@ -40,7 +51,6 @@ describe 'Group Issues Calendar Feed'  do
         visit issues_group_path(group, :ics, feed_token: user.feed_token)
 
         expect(response_headers['Content-Type']).to have_content('text/calendar')
-        expect(response_headers['Content-Disposition']).to have_content('inline')
         expect(body).to have_text('BEGIN:VCALENDAR')
       end
     end
diff --git a/spec/features/ics/project_issues_spec.rb b/spec/features/ics/project_issues_spec.rb
index b99e9607f1d..2ca3d52a5be 100644
--- a/spec/features/ics/project_issues_spec.rb
+++ b/spec/features/ics/project_issues_spec.rb
@@ -12,13 +12,25 @@ describe 'Project Issues Calendar Feed'  do
     end
 
     context 'when authenticated' do
-      it 'renders calendar feed' do
-        sign_in user
-        visit project_issues_path(project, :ics)
+      context 'with no referer' do
+        it 'renders calendar feed' do
+          sign_in user
+          visit project_issues_path(project, :ics)
 
-        expect(response_headers['Content-Type']).to have_content('text/calendar')
-        expect(response_headers['Content-Disposition']).to have_content('inline')
-        expect(body).to have_text('BEGIN:VCALENDAR')
+          expect(response_headers['Content-Type']).to have_content('text/calendar')
+          expect(body).to have_text('BEGIN:VCALENDAR')
+        end
+      end
+
+      context 'with GitLab as the referer' do
+        it 'renders calendar feed as text/plain' do
+          sign_in user
+          page.driver.header('Referer', project_issues_url(project, host: Settings.gitlab.base_url))
+          visit project_issues_path(project, :ics)
+
+          expect(response_headers['Content-Type']).to have_content('text/plain')
+          expect(body).to have_text('BEGIN:VCALENDAR')
+        end
       end
     end
 
@@ -29,7 +41,6 @@ describe 'Project Issues Calendar Feed'  do
         visit project_issues_path(project, :ics, private_token: personal_access_token.token)
 
         expect(response_headers['Content-Type']).to have_content('text/calendar')
-        expect(response_headers['Content-Disposition']).to have_content('inline')
         expect(body).to have_text('BEGIN:VCALENDAR')
       end
     end
@@ -39,7 +50,6 @@ describe 'Project Issues Calendar Feed'  do
         visit project_issues_path(project, :ics, feed_token: user.feed_token)
 
         expect(response_headers['Content-Type']).to have_content('text/calendar')
-        expect(response_headers['Content-Disposition']).to have_content('inline')
         expect(body).to have_text('BEGIN:VCALENDAR')
       end
     end