From b4a63aad7f56486c164a15ae2477bcd251b0bb1b Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Tue, 18 Mar 2014 21:10:48 -0400
Subject: [PATCH] Fix authentication security hole with external providers
---
src/test/java/com/gitblit/tests/PermissionsTest.java | 21 +++++++++++++++++++--
1 files changed, 19 insertions(+), 2 deletions(-)
diff --git a/src/test/java/com/gitblit/tests/PermissionsTest.java b/src/test/java/com/gitblit/tests/PermissionsTest.java
index 942811d..cffce51 100644
--- a/src/test/java/com/gitblit/tests/PermissionsTest.java
+++ b/src/test/java/com/gitblit/tests/PermissionsTest.java
@@ -17,7 +17,6 @@
import java.util.Date;
-import org.junit.Assert;
import org.junit.Test;
import com.gitblit.Constants.AccessPermission;
@@ -33,7 +32,7 @@
* @author James Moger
*
*/
-public class PermissionsTest extends Assert {
+public class PermissionsTest extends GitblitUnitTest {
/**
* Admin access rights/permissions
@@ -2878,4 +2877,22 @@
assertEquals("user has wrong permission!", AccessPermission.CLONE, user.getRepositoryPermission(repo).permission);
assertEquals("team has wrong permission!", AccessPermission.CLONE, team.getRepositoryPermission(repo).permission);
}
+
+ @Test
+ public void testIsMirror() throws Exception {
+ RepositoryModel repo = new RepositoryModel("somerepo.git", null, null, new Date());
+ repo.authorizationControl = AuthorizationControl.NAMED;
+ repo.accessRestriction = AccessRestrictionType.NONE;
+
+ UserModel user = new UserModel("test");
+ TeamModel team = new TeamModel("team");
+
+ assertEquals("user has wrong permission!", AccessPermission.REWIND, user.getRepositoryPermission(repo).permission);
+ assertEquals("team has wrong permission!", AccessPermission.REWIND, team.getRepositoryPermission(repo).permission);
+
+ // set repo to be a mirror, pushes prohibited
+ repo.isMirror = true;
+ assertEquals("user has wrong permission!", AccessPermission.CLONE, user.getRepositoryPermission(repo).permission);
+ assertEquals("team has wrong permission!", AccessPermission.CLONE, team.getRepositoryPermission(repo).permission);
+ }
}
--
Gitblit v1.9.1