diff --git a/ee/app/finders/packages/group_packages_finder.rb b/ee/app/finders/packages/group_packages_finder.rb index dffe4390d3706b39e3f6b71a5f93e51309a5654d..34da04b4b4cc984cb3c0d6cda084c0d1a5b4f302 100644 --- a/ee/app/finders/packages/group_packages_finder.rb +++ b/ee/app/finders/packages/group_packages_finder.rb @@ -30,8 +30,6 @@ def group_projects_visible_to_current_user ::Project .in_namespace(groups) .public_or_visible_to_user(current_user, Gitlab::Access::REPORTER) - .with_project_feature - .select { |project| Ability.allowed?(current_user, :read_package, project) } end def package_type diff --git a/ee/changelogs/unreleased/security-filter-member-only-packages-master.yml b/ee/changelogs/unreleased/security-filter-member-only-packages-master.yml deleted file mode 100644 index 26102f42beee01799d7aaf9297440ee6aba46878..0000000000000000000000000000000000000000 --- a/ee/changelogs/unreleased/security-filter-member-only-packages-master.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Filter out packages the user does'nt have permission to see at group level -merge_request: -author: -type: security diff --git a/ee/spec/finders/packages/group_packages_finder_spec.rb b/ee/spec/finders/packages/group_packages_finder_spec.rb index f9ab4dce5c0130e958d11435a7161154ff65260d..9cc6292be8fc3eb2990e4b233a4073f2d3f84926 100644 --- a/ee/spec/finders/packages/group_packages_finder_spec.rb +++ b/ee/spec/finders/packages/group_packages_finder_spec.rb @@ -72,40 +72,5 @@ def self.package_types it { is_expected.to match_array([package1])} end - - context 'when project is public' do - set(:other_user) { create(:user) } - let(:finder) { described_class.new(other_user, group) } - - before do - project.update!(visibility_level: ProjectFeature::ENABLED) - end - - context 'when packages are public' do - before do - project.project_feature.update!( - builds_access_level: ProjectFeature::PRIVATE, - merge_requests_access_level: ProjectFeature::PRIVATE, - repository_access_level: ProjectFeature::ENABLED) - end - - it 'returns group packages' do - expect(finder.execute).to match_array([package1, package2]) - end - end - - context 'packages are members only' do - before do - project.project_feature.update!( - builds_access_level: ProjectFeature::PRIVATE, - merge_requests_access_level: ProjectFeature::PRIVATE, - repository_access_level: ProjectFeature::PRIVATE) - end - - it 'filters out the project if the user doesn\'t have permission' do - expect(finder.execute).to be_empty - end - end - end end end