Commit d2cec126 authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets
Browse files

block user should not be able to push

parent 93e75b79b18d
......@@ -20,6 +20,9 @@ class Internal < Grape::API
project == key.project && git_cmd == 'git-upload-pack'
else
user = key.user
return false if user.blocked?
action = case git_cmd
when 'git-upload-pack'
then :download_code
......
......@@ -34,13 +34,7 @@
context "git pull" do
it do
get(
api("/internal/allowed"),
ref: 'master',
key_id: key.id,
project: project.path_with_namespace,
action: 'git-upload-pack'
)
pull(key, project)
response.status.should == 200
response.body.should == 'true'
......@@ -49,13 +43,7 @@
context "git push" do
it do
get(
api("/internal/allowed"),
ref: 'master',
key_id: key.id,
project: project.path_with_namespace,
action: 'git-receive-pack'
)
push(key, project)
response.status.should == 200
response.body.should == 'true'
......@@ -70,13 +58,7 @@
context "git pull" do
it do
get(
api("/internal/allowed"),
ref: 'master',
key_id: key.id,
project: project.path_with_namespace,
action: 'git-upload-pack'
)
pull(key, project)
response.status.should == 200
response.body.should == 'false'
......@@ -85,13 +67,7 @@
context "git push" do
it do
get(
api("/internal/allowed"),
ref: 'master',
key_id: key.id,
project: project.path_with_namespace,
action: 'git-receive-pack'
)
push(key, project)
response.status.should == 200
response.body.should == 'false'
......@@ -99,5 +75,50 @@
end
end
context "blocked user" do
let(:personal_project) { create(:project, namespace: user.namespace) }
before do
user.block
end
context "git pull" do
it do
pull(key, personal_project)
response.status.should == 200
response.body.should == 'false'
end
end
context "git push" do
it do
push(key, personal_project)
response.status.should == 200
response.body.should == 'false'
end
end
end
end
def pull(key, project)
get(
api("/internal/allowed"),
ref: 'master',
key_id: key.id,
project: project.path_with_namespace,
action: 'git-upload-pack'
)
end
def push(key, project)
get(
api("/internal/allowed"),
ref: 'master',
key_id: key.id,
project: project.path_with_namespace,
action: 'git-receive-pack'
)
end
end
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment