diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb index e347f542605347bcdd6929950aa9bb4c406599ab..1183dd136d0737e2f9cbb53a19f4657c53023d5a 100644 --- a/app/controllers/projects_controller.rb +++ b/app/controllers/projects_controller.rb @@ -327,9 +327,9 @@ class ProjectsController < Projects::ApplicationController end # rubocop: enable CodeReuse/ActiveRecord - def project_params(attributes: project_params_attributes) + def project_params(attributes: []) params.require(:project) - .permit(attributes) + .permit(project_params_attributes + attributes) end def project_params_attributes @@ -374,7 +374,7 @@ class ProjectsController < Projects::ApplicationController end def project_params_create_attributes - project_params_attributes << :namespace_id + [:namespace_id] end def custom_import_params diff --git a/changelogs/unreleased/security-mass-assignment-on-project-update.yml b/changelogs/unreleased/security-mass-assignment-on-project-update.yml index 8657dcdd135a98a0456d674cf990c761e35ed7b8..93561cd91b3a1ae4169e15620b1a7c0aa36a9296 100644 --- a/changelogs/unreleased/security-mass-assignment-on-project-update.yml +++ b/changelogs/unreleased/security-mass-assignment-on-project-update.yml @@ -1,5 +1,5 @@ --- -title: Disallow updating namespace during updating project +title: Disallow updating namespace when updating a project merge_request: author: type: security diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb index d060a621cab172ab10368de809a169f918dbfd7e..c598c7b8732cf6f588ccd5d15b5b17365c54db45 100644 --- a/spec/controllers/projects_controller_spec.rb +++ b/spec/controllers/projects_controller_spec.rb @@ -383,7 +383,7 @@ describe ProjectsController do id: project.id, project: params } - end.not_to change {project.namespace} + end.not_to change {project.reload.namespace} end def update_project(**parameters)