Add latest changes from gitlab-org/security/gitlab@15-4-stable-ee

4 files changed, 25 insertions, 2 deletions

diff --git a/app/models/user.rb b/app/models/user.rb
index 8825c18ea48..3f07e1b1ec0 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -2159,6 +2159,10 @@ class User < ApplicationRecord
     (Date.current - created_at.to_date).to_i
   end
 
+  def webhook_email
+    public_email.presence || _('[REDACTED]')
+  end
+
   protected
 
   # override, from Devise::Validatable
diff --git a/lib/gitlab/hook_data/group_member_builder.rb b/lib/gitlab/hook_data/group_member_builder.rb
index 2998550a4b5..d70885018e9 100644
--- a/lib/gitlab/hook_data/group_member_builder.rb
+++ b/lib/gitlab/hook_data/group_member_builder.rb
@@ -39,7 +39,7 @@ module Gitlab
           group_id: group_member.group.id,
           user_username: group_member.user.username,
           user_name: group_member.user.name,
-          user_email: group_member.user.email,
+          user_email: group_member.user.webhook_email,
           user_id: group_member.user.id,
           group_access: group_member.human_access,
           expires_at: group_member.expires_at&.xmlschema
diff --git a/spec/lib/gitlab/hook_data/group_member_builder_spec.rb b/spec/lib/gitlab/hook_data/group_member_builder_spec.rb
index 35ce31ab897..1551bdbaa9c 100644
--- a/spec/lib/gitlab/hook_data/group_member_builder_spec.rb
+++ b/spec/lib/gitlab/hook_data/group_member_builder_spec.rb
@@ -26,7 +26,7 @@ RSpec.describe Gitlab::HookData::GroupMemberBuilder do
           expect(data[:group_id]).to eq(group.id)
           expect(data[:user_username]).to eq(group_member.user.username)
           expect(data[:user_name]).to eq(group_member.user.name)
-          expect(data[:user_email]).to eq(group_member.user.email)
+          expect(data[:user_email]).to eq(group_member.user.webhook_email)
           expect(data[:user_id]).to eq(group_member.user.id)
           expect(data[:group_access]).to eq('Developer')
           expect(data[:created_at]).to eq(group_member.created_at&.xmlschema)
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 04f2c7f9176..3cc34681ad6 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -6866,6 +6866,25 @@ RSpec.describe User do
     end
   end
 
+  describe '#webhook_email' do
+    let(:user) { build(:user, public_email: nil) }
+
+    context 'when public email is present' do
+      before do
+        user.public_email = "hello@hello.com"
+      end
+      it 'returns public email' do
+        expect(user.webhook_email).to eq(user.public_email)
+      end
+    end
+
+    context 'when public email is nil' do
+      it 'returns [REDACTED]' do
+        expect(user.webhook_email).to eq(_('[REDACTED]'))
+      end
+    end
+  end
+
   describe 'user credit card validation' do
     context 'when user is initialized' do
       let(:user) { build(:user) }