Skip to content
Snippets Groups Projects

Newly created Masked and Hidden CI variable can be viewed after creation

    • Open Issue created by Armin Hergenhan @ahergenhan

    Summary

    It is possible to view a newly created CI variable that is set to Hidden and Masked. This is only possible on the CI Variables screen after it has just been created using the following steps.

    Steps to reproduce

    1. create a new project
    2. add a new CI variable named TEST_VISIBLE with the following settings:
      • Type: Variable (default)
      • Environments: All (default)
      • Visibility: Visible
      • Flags: both unchecked
      • No description
      • any string value
    3. Save the variable
    4. add a new CI variable named TEST_SECRET with the following settings:
      • Type: Variable (default)
      • Environments: All (default)
      • Visibility: Masked and hidden
      • Flags: both unchecked
      • No description
      • set a value of mysecretvalue
    5. save the value
    6. close the Edit variable pop out but do not navigate away from the screen or refresh the window
    7. click the Edit pencil next to TEST_SECRET => the Edit attribute pop-out shows correctly (variable value is hidden)
    8. without closing the po-out click the Edit pencil next to TEST_VISIBLE

    The Edit attribute pop-out refreshes but instead of showing the TEST_VISIBLE value it shows the TEST_SECRET attribute and value

    Example Project

    This can be reproduced in any project but will only occur at the time of when the variable is being created

    What is the current bug behavior?

    The hidden variable value can be viewed again. Also the Edit shows the wrong attribute.

    What is the expected correct behavior?

    Relevant logs and/or screenshots

    Output of checks

    Results of GitLab environment info

    Expand for output related to GitLab environment info 
    (For installations with omnibus-gitlab package run and paste the output of:
`sudo gitlab-rake gitlab:env:info`)

(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

    Results of GitLab application Check

    Expand for output related to the GitLab application check 
    (For installations with omnibus-gitlab package run and paste the output of:
sudo gitlab-rake gitlab:check SANITIZE=true)
    

    (For installations from source run and paste the output of:
sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production SANITIZE=true)
    

    (we will only investigate if the tests are passing)

    Possible fixes

    Edited by Armin Hergenhan

    Designs

      Child items ...

      2. Activity

      Please register or sign in to reply