Merge branch 'security-64938-dont-disclose-path-12-1-ce' into '12-1-stable'

Redirect user to root path after unsubscribing from private resource See merge request gitlab/gitlabhq!3418

Merge branch 'security-64938-dont-disclose-path-12-1-ce' into '12-1-stable'
Redirect user to root path after unsubscribing from private resource See merge request gitlab/gitlabhq!3418
18771468 · GitLab Release Tools Bot · f6fce08b · f991af9a · 18771468 · 18771468
--- a/app/controllers/sent_notifications_controller.rb
+++ b/app/controllers/sent_notifications_controller.rb
@@ -19,7 +19,11 @@ def unsubscribe_and_redirect
    flash[:notice] = _("You have been unsubscribed from this thread.")

    if current_user
-      redirect_to noteable_path(noteable)
+      if current_user.can?(:"read_#{noteable.class.to_ability_name}", noteable)
+        redirect_to noteable_path(noteable)
+      else
+        redirect_to root_path
+      end
    else
      redirect_to new_user_session_path
    end

--- a/changelogs/unreleased/security-64938-dont-disclose-path.yml
+++ b/changelogs/unreleased/security-64938-dont-disclose-path.yml
+---
+title: Fix new project path being disclosed through unsubscribe link of issue/merge
+  requests
+merge_request:
+author:
+type: security
--- a/spec/controllers/sent_notifications_controller_spec.rb
+++ b/spec/controllers/sent_notifications_controller_spec.rb
@@ -208,6 +208,35 @@
            .to redirect_to(project_merge_request_path(project, merge_request))
        end
      end
+
+      context 'when project is private' do
+        context 'and user does not have access' do
+          let(:noteable) { issue }
+          let(:target_project) { private_project }
+
+          before do
+            get(:unsubscribe, params: { id: sent_notification.reply_key })
+          end
+
+          it 'unsubscribes user and redirects to root path' do
+            expect(response).to redirect_to(root_path)
+          end
+        end
+
+        context 'and user has access' do
+          let(:noteable) { issue }
+          let(:target_project) { private_project }
+
+          before do
+            private_project.add_developer(user)
+            get(:unsubscribe, params: { id: sent_notification.reply_key })
+          end
+
+          it 'unsubscribes user and redirects to issue path' do
+            expect(response).to redirect_to(project_issue_path(private_project, issue))
+          end
+        end
+      end
    end
  end
 end