diff --git a/CHANGELOG-EE b/CHANGELOG-EE index d5fabbb0cb9877b3d256c0760bfbdac59d089a9b..645119369c89fe37b5bb66d593e2a13ce5b5d1f5 100644 --- a/CHANGELOG-EE +++ b/CHANGELOG-EE @@ -3,6 +3,9 @@ Please view this file on the master branch, on stable branches it's out of date. v 8.10.0 (unreleased) - Rename Git Hooks to Push Rules +v 8.9.5 + - Prevent stale data in LDAP group sync last owner check. + v 8.9.4 - Improve how File Lock feature works with nested items. !497 diff --git a/lib/gitlab/ldap/group_sync.rb b/lib/gitlab/ldap/group_sync.rb index 88886759755d53d01cb8bb300ee4ebb86d9ba455..86a445f5ebedc707e7ff951b0ed8c72025cb33b6 100644 --- a/lib/gitlab/ldap/group_sync.rb +++ b/lib/gitlab/ldap/group_sync.rb @@ -304,6 +304,11 @@ def update_existing_group_membership(group, access_levels) next end + # Since we're removing users in this loop, `group.reload` + # before checking `last_owner?` to prevent stale owner information. + # Without a reload, this check would return a false negative. + group.reload + # Check and update the access level. If `desired_access` is `nil` # we need to delete the user from the group. if desired_access.present?