Skip to content

Added authentication on autocomplete_sources members endpoint

What does this MR do and why?

  1. This MR fixes a bug in the autocomplete sources endpoint while fetching members list by an anonymous user.
  2. The expected behaviour from the autocomplete_sources endpoint is that it should redirect to login page if the user is not logged in, but because of the bug, anonymous users are able to fetch the list of members. For example check https://gitlab.com/gitlab-org/gitlab/-/autocomplete_sources/members?type=MergeRequest&type_id=96848 in incognito window without logging in.
  3. The expected behaviour was deduced from the test cases written for this endpoint.
  4. This MR makes user authentication compulsory for this endpoint.

Screenshots or screen recordings

Project member: After and before will be same.

image

Non project member: After and before will be same.

image

Anonymous user:

Before

image

After

image

How to set up and validate locally

  1. Create a public project public_project under group public_group.
  2. Add user user1 to the public_project as members.
  3. Create an issue in the public_project by user1. Let's say the id of this issue is 1.
  4. user1 and user2(random user who is not a project member) should be able to get a json array containing list of project members when trying to open url http://127.0.0.1:3000/public_group/public_project/-/autocomplete_sources/members?type=Issue&type_id=1 in the browser window where the users are logged in.
  5. If no user is logged in then on opening http://127.0.0.1:3000/public_group/public_project/-/autocomplete_sources/members?type=Issue&type_id=1 you should get the login screen.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #36069 (closed)

Edited by Hitesh Raghuvanshi

Merge request reports