UI shows incorrect permissions from cache

Summary

Users are seeing incorrect permissions for the listed projects in / and /dashboard/projects based on what is stored in the Redis cache from another user at the time they access those routes. The two routes' caches are separate and can result in one showing different permissions than the other for the same projects for that user.

Steps to reproduce

  1. Must have at least two users that are on projects together with different permission levels.
  2. Login with one user and note the permission levels for their listed projects.
  3. Clear Redis cache (with rake).
  4. Login with another user and access / and/or /dashboard/projects - note the permission levels for projects.
  5. Refresh or re-login with the first user.

NOTE: This doesn't affect actual permissions - it is just the UI.

What is the current bug behavior?

Users can see incorrect permission levels for projects they are on based on the permission level of another user on those projects.

What is the expected correct behavior?

Users should always see their own permission levels for the projects.

Relevant logs and/or screenshots

cacheIssueExample

Above gif shows an example of what happens after cache clears. The first user's permissions gets corrected after the cache clears, but subsequent users who access their projects page has their permissions changed to match the first user.

Output of checks

Results of GitLab environment info

Expand for output related to GitLab environment info 
System information
System:		Ubuntu 14.04
Current User:	git
Using RVM:	no
Ruby Version:	2.3.6p384
Gem Version:	2.6.13
Bundler Version:1.13.7
Rake Version:	12.3.0
Redis Version:	3.2.11
Git Version:	2.14.3
Sidekiq Version:5.0.5
Go Version:	unknown

GitLab information
Version:	10.4.3
Revision:	183dd5d
Directory:	/opt/gitlab/embedded/service/gitlab-rails
DB Adapter:	postgresql
URL:		http://git.procpr.org
HTTP Clone URL:	http://git.procpr.org/some-group/some-project.git
SSH Clone URL:	git@git.procpr.org:some-group/some-project.git
Using LDAP:	no
Using Omniauth:	no


GitLab Shell
Version:	5.11.0
Repository storage paths:
  • default: /var/opt/gitlab/git-data/repositories Hooks: /opt/gitlab/embedded/service/gitlab-shell/hooks Git: /opt/gitlab/embedded/bin/git

Results of GitLab application Check

Expand for output related to the GitLab application check 
Checking GitLab Shell ...

GitLab Shell version >= 5.11.0 ? ... OK (5.11.0)
Repo base directory exists?
default... yes
Repo storage directories are symlinks?
default... no
Repo paths owned by git:root, or git:git?
default... yes
Repo paths access is drwxrws---?
default... yes
hooks directories in repos are links: ...
2/2 ... ok
2/3 ... ok
2/4 ... ok
2/6 ... ok
2/7 ... ok
1/8 ... ok
7/9 ... ok
7/10 ... ok
1/11 ... ok
2/12 ... ok
1/13 ... ok
1/14 ... ok
2/15 ... ok
1/16 ... ok
2/17 ... ok
2/18 ... ok
1/19 ... ok
2/20 ... ok
2/21 ... ok
2/22 ... ok
1/23 ... ok
1/24 ... ok
12/25 ... ok
2/27 ... repository is empty
2/28 ... ok
12/29 ... ok
12/30 ... ok
2/31 ... ok
12/33 ... ok
Running /opt/gitlab/embedded/service/gitlab-shell/bin/check
Check GitLab API access: OK
Redis available via internal API: OK


Access to /var/opt/gitlab/.ssh/authorized_keys: OK
gitlab-shell self-check successful


Checking GitLab Shell ... Finished


Checking Sidekiq ...


Running? ... yes
Number of Sidekiq processes ... 1


Checking Sidekiq ... Finished


Reply by email is disabled in config/gitlab.yml
Checking LDAP ...


LDAP is disabled in config/gitlab.yml


Checking LDAP ... Finished


Checking GitLab ...


Git configured correctly? ... yes
Database config exists? ... yes
All migrations up? ... yes
Database contains orphaned GroupMembers? ... no
GitLab config exists? ... yes
GitLab config up to date? ... yes
Log directory writable? ... yes
Tmp directory writable? ... yes
Uploads directory exists? ... yes
Uploads directory has correct permissions? ... yes
Uploads directory tmp has correct permissions? ... no
Try fixing it:
sudo chown -R git /var/opt/gitlab/gitlab-rails/uploads
sudo find /var/opt/gitlab/gitlab-rails/uploads -type f -exec chmod 0644 {} ;
sudo find /var/opt/gitlab/gitlab-rails/uploads -type d -not -path /var/opt/gitlab/gitlab-rails/uploads -exec chmod 0700 {} ;
For more information see:
doc/install/installation.md in section "GitLab"
Please fix the error above and rerun the checks.
Init script exists? ... skipped (omnibus-gitlab has no init script)
Init script up-to-date? ... skipped (omnibus-gitlab has no init script)
Projects have namespace: ...
2/2 ... yes
2/3 ... yes
2/4 ... yes
2/6 ... yes
2/7 ... yes
1/8 ... yes
7/9 ... yes
7/10 ... yes
1/11 ... yes
2/12 ... yes
1/13 ... yes
1/14 ... yes
2/15 ... yes
1/16 ... yes
2/17 ... yes
2/18 ... yes
1/19 ... yes
2/20 ... yes
2/21 ... yes
2/22 ... yes
1/23 ... yes
1/24 ... yes
12/25 ... yes
2/27 ... yes
2/28 ... yes
12/29 ... yes
12/30 ... yes
2/31 ... yes
12/33 ... yes
Redis version >= 2.8.0? ... yes
Ruby version >= 2.3.5 ? ... yes (2.3.6)
Git version >= 2.7.3 ? ... yes (2.14.3)
Git user has default SSH configuration? ... yes
Active users: ... 8


Checking GitLab ... Finished

Reported by customer:

Ticket

Edited by Namho Kim