Skip to content

Fix internal projects not being found by custom templates finder

What does this MR do?

Fix #263305 (closed)

The problem is:

  1. CustomTemplatesFinder filters projects by visibility of almost all features. It was done because we use export/import feature for templates and user by using templates could gain access to content he should be able to see: e.g. issues if they set to be private for internal project.
  2. If you create internal project, pages default access level will be PRIVATE, which makes finder filter that project out.
  3. Users can't actually change the pages access level without enabling access control on the instance.

We could also fix this by #326353, but I'm not 100% right now how to do that, so simply ignoring pages in that context makes more sense to me.

Also, I think ideally initial security issue should be fixed by ignoring some feature during export, not by filtering projects out.

Screenshots (strongly suggested)

Does this MR meet the acceptance criteria?

Conformity

Availability and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Related to #263305 (closed)

Edited by Vladimir Shushlin

Merge request reports