Fix global anonymous searches restriction
What does this MR do and why?
This MR fixes block_anonymous_global_searches
and check_scope_global_search_enabled
methods which enforce global search restrictions. Currently it's possible to circumvent them by adding project_id=x
to the query. This MR ensures that we actually check that we have group
or project
set in the search_service
.
This MR doesn't have a changelog entry since related feature flags are disabled by default
https://gitlab.com/gitlab-org/gitlab/-/issues/346510
Screenshots or screen recordings
Before
After
How to set up and validate locally
- Configure Advanced Search if it's not enabled already https://gitlab.com/gitlab-org/gitlab-development-kit/-/blob/main/doc/howto/elasticsearch.md
- Checkout the
master
branch - In rails console enable the feature flag
Feature.enable(:block_anonymous_global_searches)
- Using an incognito/private browser window open
http://localhost:3000/search?project_id=x&scope=blobs&search=test
- Ensure that you see the results page
- Checkout to this MR's branch
- Refresh the page
- You should see the login page with a warning
You must be logged in to search across all of GitLab
MR acceptance checklist
This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.
-
I have evaluated the MR acceptance checklist for this MR.
Closes #346510
Edited by Dmitry Gruzd