Skip to content

Prevent removal of last blocked group owner [RUN ALL RSPEC] [RUN AS-IF-FOSS]

What does this MR do?

By default, it's prevented to remove the last owner of a group. This works as desired if the last owner is an active user. However, the last owner of a group can me removed if it's a blocked user (UI and API). This bug allows to get orphaned groups.

So this bug is solved in this MR.

🛠 with at Siemens

/cc @bufferoverflow

Screenshots

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • [-] Label as security and @ mention @gitlab-com/gl-security/appsec
  • [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Drew Blessing

Merge request reports