summaryrefslogtreecommitdiff
path: root/app
diff options
context:
space:
mode:
Diffstat (limited to 'app')
-rw-r--r--app/controllers/groups/application_controller.rb2
-rw-r--r--app/controllers/groups_controller.rb11
-rw-r--r--app/helpers/visibility_level_helper.rb3
-rw-r--r--app/models/ability.rb2
-rw-r--r--app/models/group.rb22
-rw-r--r--app/models/project.rb20
-rw-r--r--app/services/groups/base_service.rb15
-rw-r--r--app/services/groups/create_service.rb8
-rw-r--r--app/services/groups/update_service.rb17
-rw-r--r--app/services/projects/create_service.rb13
-rw-r--r--app/views/groups/show.html.haml3
11 files changed, 61 insertions, 55 deletions
diff --git a/app/controllers/groups/application_controller.rb b/app/controllers/groups/application_controller.rb
index be801858eaf..795ce50fe92 100644
--- a/app/controllers/groups/application_controller.rb
+++ b/app/controllers/groups/application_controller.rb
@@ -9,7 +9,7 @@ class Groups::ApplicationController < ApplicationController
end
def authorize_read_group!
- unless @group and can?(current_user, :read_group, @group)
+ unless @group && can?(current_user, :read_group, @group)
if current_user.nil?
return authenticate_user!
else
diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index ba2057eb2c8..b635fb150ae 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -105,17 +105,6 @@ class GroupsController < Groups::ApplicationController
@projects ||= ProjectsFinder.new.execute(current_user, group: group).sorted_by_activity
end
- # Dont allow unauthorized access to group
- def authorize_read_group!
- unless can?(current_user, :read_group, @group)
- if current_user.nil?
- return authenticate_user!
- else
- return render_404
- end
- end
- end
-
def authorize_create_group!
unless can?(current_user, :create_group, nil)
return render_404
diff --git a/app/helpers/visibility_level_helper.rb b/app/helpers/visibility_level_helper.rb
index 930cc883634..7fa18ba9079 100644
--- a/app/helpers/visibility_level_helper.rb
+++ b/app/helpers/visibility_level_helper.rb
@@ -85,7 +85,6 @@ module VisibilityLevelHelper
end
def skip_level?(form_model, level)
- form_model.is_a?(Project) &&
- !form_model.visibility_level_allowed?(level)
+ form_model.is_a?(Project) && !form_model.visibility_level_allowed?(level)
end
end
diff --git a/app/models/ability.rb b/app/models/ability.rb
index ffcf05dcd33..61d5e7dc859 100644
--- a/app/models/ability.rb
+++ b/app/models/ability.rb
@@ -295,7 +295,7 @@ class Ability
end
def can_read_group?(user, group)
- user.admin? || group.public? || (group.internal? && !user.external?) || group.users.include?(user) ||
+ user.admin? || group.public? || (group.internal? && !user.external?) || group.users.include?(user) ||
ProjectsFinder.new.execute(user, group: group).any?
end
diff --git a/app/models/group.rb b/app/models/group.rb
index b094a65e3d6..17c69af4d1b 100644
--- a/app/models/group.rb
+++ b/app/models/group.rb
@@ -29,6 +29,8 @@ class Group < Namespace
has_many :shared_projects, through: :project_group_links, source: :project
validate :avatar_type, if: ->(user) { user.avatar.present? && user.avatar_changed? }
+ validate :visibility_level_allowed_by_projects
+
validates :avatar, file_size: { maximum: 200.kilobytes.to_i }
mount_uploader :avatar, AvatarUploader
@@ -80,6 +82,26 @@ class Group < Namespace
visibility_level
end
+ def visibility_level_allowed_by_projects
+ unless visibility_level_allowed?
+ level_name = Gitlab::VisibilityLevel.level_name(visibility_level).downcase
+ self.errors.add(:visibility_level, "#{level_name} is not allowed since there are projects with higher visibility.")
+ end
+ end
+
+ def visibility_level_allowed?
+ projects_visibility = self.projects.pluck(:visibility_level)
+
+ allowed_by_projects = projects_visibility.none? { |project_visibility| self.visibility_level < project_visibility }
+
+ unless allowed_by_projects
+ level_name = Gitlab::VisibilityLevel.level_name(visibility_level).downcase
+ self.errors.add(:visibility_level, "#{level_name} is not allowed since there are projects with higher visibility.")
+ end
+
+ allowed_by_projects
+ end
+
def avatar_url(size = nil)
if avatar.present?
[gitlab_config.url, avatar.url].join
diff --git a/app/models/project.rb b/app/models/project.rb
index 2828385a5f6..7c10ab35431 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -73,7 +73,7 @@ class Project < ActiveRecord::Base
update_column(:last_activity_at, self.created_at)
end
- # update visibility_levet of forks
+ # update visibility_level of forks
after_update :update_forks_visibility_level
def update_forks_visibility_level
return unless visibility_level < visibility_level_was
@@ -197,6 +197,7 @@ class Project < ActiveRecord::Base
validate :avatar_type,
if: ->(project) { project.avatar.present? && project.avatar_changed? }
validates :avatar, file_size: { maximum: 200.kilobytes.to_i }
+ validate :visibility_level_allowed_in_group
add_authentication_token_field :runners_token
before_save :ensure_runners_token
@@ -446,6 +447,12 @@ class Project < ActiveRecord::Base
errors[:base] << ("Can't check your ability to create project")
end
+ def visibility_level_allowed_in_group
+ unless visibility_level_allowed?
+ self.errors.add(:visibility_level, "#{self.visibility_level} is not allowed in a #{self.group.visibility_level} group.")
+ end
+ end
+
def to_param
path
end
@@ -961,9 +968,14 @@ class Project < ActiveRecord::Base
issues.opened.count
end
- def visibility_level_allowed?(level)
- allowed_by_forks = forked? ? Gitlab::VisibilityLevel.allowed_fork_levels(forked_from_project.visibility_level).include?(level.to_i) : true
- allowed_by_groups = group.present? ? level.to_i <= group.visibility_level : true
+ def visibility_level_allowed?(level = self.visibility_level)
+ allowed_by_forks = if forked?
+ Gitlab::VisibilityLevel.allowed_fork_levels(forked_from_project.visibility_level).include?(level)
+ else
+ true
+ end
+
+ allowed_by_groups = group.present? ? level <= group.visibility_level : true
allowed_by_forks && allowed_by_groups
end
diff --git a/app/services/groups/base_service.rb b/app/services/groups/base_service.rb
index 053b6a05281..1db81216084 100644
--- a/app/services/groups/base_service.rb
+++ b/app/services/groups/base_service.rb
@@ -8,18 +8,13 @@ module Groups
private
- def visibility_allowed_for_user?(level)
+ def visibility_allowed_for_user?
+ level = group.visibility_level
allowed_by_user = Gitlab::VisibilityLevel.allowed_for?(current_user, level)
- @group.errors.add(:visibility_level, "You are not authorized to set this permission level.") unless allowed_by_user
- allowed_by_user
- end
- def visibility_allowed_for_project?(level)
- projects_visibility = group.projects.pluck(:visibility_level)
-
- allowed_by_projects = !projects_visibility.any? { |project_visibility| level.to_i < project_visibility }
- @group.errors.add(:visibility_level, "Cannot be changed. There are projects with higher visibility permissions.") unless allowed_by_projects
- allowed_by_projects
+ group.errors.add(:visibility_level, "#{level} has been restricted by your GitLab administrator.") unless allowed_by_user
+
+ allowed_by_user
end
end
end
diff --git a/app/services/groups/create_service.rb b/app/services/groups/create_service.rb
index 38742369d82..f605ccca81b 100644
--- a/app/services/groups/create_service.rb
+++ b/app/services/groups/create_service.rb
@@ -2,14 +2,16 @@ module Groups
class CreateService < Groups::BaseService
def initialize(user, params = {})
@current_user, @params = user, params.dup
- @group = Group.new(@params)
end
def execute
- return @group unless visibility_allowed_for_user?(@params[:visibility_level])
+ @group = Group.new(params)
+
+ return @group unless visibility_allowed_for_user?
+
@group.name = @group.path.dup unless @group.name
@group.save
- @group.add_owner(@current_user)
+ @group.add_owner(current_user)
@group
end
end
diff --git a/app/services/groups/update_service.rb b/app/services/groups/update_service.rb
index b910e0fde98..0b0c5a35d37 100644
--- a/app/services/groups/update_service.rb
+++ b/app/services/groups/update_service.rb
@@ -1,20 +1,15 @@
-#Checks visibility level permission check before updating a group
-#Do not allow to put Group visibility level smaller than its projects
-#Do not allow unauthorized permission levels
+# Checks visibility level permission check before updating a group
+# Do not allow to put Group visibility level smaller than its projects
+# Do not allow unauthorized permission levels
module Groups
class UpdateService < Groups::BaseService
def execute
- return false unless visibility_level_allowed?(params[:visibility_level])
- group.update_attributes(params)
- end
-
- private
+ group.assign_attributes(params)
- def visibility_level_allowed?(level)
- return true unless level.present?
+ return false unless visibility_allowed_for_user?
- visibility_allowed_for_project?(level) && visibility_allowed_for_user?(level)
+ group.save
end
end
end
diff --git a/app/services/projects/create_service.rb b/app/services/projects/create_service.rb
index 4c121106bda..cebfc432002 100644
--- a/app/services/projects/create_service.rb
+++ b/app/services/projects/create_service.rb
@@ -9,13 +9,8 @@ module Projects
@project = Project.new(params)
- # Make sure that the user is allowed to use the specified visibility
- # level
-
- unless visibility_level_allowed?
- deny_visibility_level(@project)
- return @project
- end
+ # Make sure that the user is allowed to use the specified visibility level
+ return @project unless visibility_level_allowed?
# Set project name from path
if @project.name.present? && @project.path.present?
@@ -55,9 +50,7 @@ module Projects
@project.save
if @project.persisted? && !@project.import?
- unless @project.create_repository
- raise 'Failed to create repository'
- end
+ raise 'Failed to create repository' unless @project.create_repository
end
end
diff --git a/app/views/groups/show.html.haml b/app/views/groups/show.html.haml
index 4be117667db..222c3e4a40e 100644
--- a/app/views/groups/show.html.haml
+++ b/app/views/groups/show.html.haml
@@ -17,8 +17,7 @@
.cover-title
%h1
= @group.name
-
- %span.visibility-icon.has_tooltip{data: { container: 'body', placement: 'left' }, title: "#{group_visibility_description(@group)}"}
+ %span.visibility-icon.has_tooltip{ data: { container: 'body', placement: 'left' }, title: group_visibility_description(@group) }
= visibility_level_icon(@group.visibility_level, fw: false)
.cover-desc.username
View Lorry Controller Status