Skip to content

Prevent guests from assigning issues from note actions

Marco Zille requested to merge zillemarco/gitlab:zillemarco-hide-assign-when-issue-admin-not-allowed into master

What does this MR do and why?

I noticed that guest users could see the Assign to/Unassign from commenting user action on the issues notes even if that users can't actually admin the issue (because his guest access).

This MR fixes this problem 🙂

re #332270 (closed)

Screenshots or screen recordings

Before After
image image

How to set up and validate locally

  1. On your local GDK find a user with guest access to a project
  2. Impersonate that user
  3. Go to the project where the impersonated user is a guest
  4. Create a issue (or open an existing one which was created by the same guest)
  5. Add a comment to that issue
  6. The action button Assign to/Unassign from commenting user should not be visibile anymore
  7. Going back to the same issue impersonating a user with at least report role, that action button should instead be visible

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Alexandru Croitor

Merge request reports