Skip to content

Fix opensearch for anonymous users

Dmitry Gruzd requested to merge fix-opensearch into master

What does this MR do?

While testing !52583 (merged) on staging, I noticed that because of the :block_anonymous_global_searches feature flag we prevent loading of a new opensearch action, which results in anonymous users failure to add the GitLab search engine.

This MR excludes opensearch from before_action :block_anonymous_global_searches

Steps to repeat the issue

  1. Feature.enable(:block_anonymous_global_searches) in the rails console
  2. curl -q -v http://localhost:3000/search/opensearch.xml will return a redirect instead of a 200 response

Screenshots (strongly suggested)

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Dmitry Gruzd

Merge request reports