Disabling the setting to prevent projects from being shared with groups is not applied to subgroups
Summary
When configuring a group to Prevent projects from being shared with groups, the share_with_group_lock
setting is applied to all subgroups unless overridden by a group owner. However, when disabling the setting, it is not applied to all subgroups and requires manual correction of all affected groups.
Reported by customers in Zendesk tickets(internal):
Steps to reproduce
- Create a group
- Create sub-groups under the group
- Enable the Prevent projects from being shared with groups setting on the top group
- Observe that the setting is enabled for the group and subgroups
What is the current bug behavior?
- When disabling the setting at the top group, the sub-groups do not have the setting disabled.
What is the expected correct behavior?
- Sub-groups should have the setting disabled if they were not overridden by a group owner.
Possible fixes
gitlab-foss!13944 (merged) is the MR that introduced this
- https://gitlab.com/gitlab-org/gitlab/-/blob/6aade71a69769113c67dc136e25e008726720158/app/models/namespace.rb#L141-143
- https://gitlab.com/gitlab-org/gitlab/-/blob/6aade71a69769113c67dc136e25e008726720158/app/models/namespace.rb#L746-759
It is is likely unsafe to disable this setting for all sub-groups. More work is needed to design a flow that is safe. See discussion in #410222 (comment 1604591979)
Edited by Thong Kuah