Fix internal projects not being found by custom templates finder
requested to merge 263305-regression-custom-project-templates-no-longer-work-with-internal-visibility into master
What does this MR do?
Fix #263305 (closed)
The problem is:
- CustomTemplatesFinder filters projects by visibility of almost all features. It was done because we use export/import feature for templates and user by using templates could gain access to content he should be able to see: e.g. issues if they set to be private for internal project.
- If you create internal project, pages default access level will be
PRIVATE
, which makes finder filter that project out. - Users can't actually change the pages access level without enabling access control on the instance.
We could also fix this by #326353, but I'm not 100% right now how to do that, so simply ignoring pages in that context makes more sense to me.
Also, I think ideally initial security issue should be fixed by ignoring some feature during export, not by filtering projects out.
Screenshots (strongly suggested)
Does this MR meet the acceptance criteria?
Conformity
-
📋 Does this MR need a changelog?-
I have included a changelog entry. -
I have not included a changelog entry because _____.
-
-
Documentation (if required) -
Code review guidelines -
Merge request performance guidelines -
Style guides -
Database guides -
Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers -
Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
-
Label as security and @ mention @gitlab-com/gl-security/appsec
-
The MR includes necessary changes to maintain consistency between UI, API, email, or other methods -
Security reports checked/validated by a reviewer from the AppSec team
Related to #263305 (closed)
Edited by Vladimir Shushlin