From 00af56614a163d358247a275fbfe7f6aaae7441f Mon Sep 17 00:00:00 2001
From: Phil Hughes <me@iamphill.com>
Date: Tue, 31 May 2022 15:06:15 +0100
Subject: [PATCH] Add setting for enforcing media authenticaton

https://gitlab.com/gitlab-org/gitlab/-/issues/26781/
---
 .../permissions/components/settings_panel.vue | 49 +++++++++++++++----
 app/controllers/projects_controller.rb        |  4 ++
 locale/gitlab.pot                             |  9 ++++
 3 files changed, 53 insertions(+), 9 deletions(-)

diff --git a/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue b/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue
index d598941bade411..81b0dbec0bd3bd 100644
--- a/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue
+++ b/app/assets/javascripts/pages/projects/shared/permissions/components/settings_panel.vue
@@ -205,6 +205,7 @@ export default {
       warnAboutPotentiallyUnwantedCharacters: true,
       lfsEnabled: true,
       requestAccessEnabled: true,
+      enforceAuthChecksOnUploads: true,
       highlightChangesClass: false,
       emailsDisabled: false,
       cveIdRequestEnabled: true,
@@ -309,6 +310,13 @@ export default {
     packageRegistryAccessLevelEnabled() {
       return this.glFeatures.packageRegistryAccessLevel;
     },
+    showAdditonalSettings() {
+      if (this.glFeatures.enforceAuthChecksOnUploads) {
+        return true;
+      }
+
+      return this.visibilityLevel !== this.visibilityOptions.PRIVATE;
+    },
   },
 
   watch: {
@@ -519,15 +527,38 @@ export default {
           )
         }}</span>
         <span class="form-text text-muted">{{ visibilityLevelDescription }}</span>
-        <label v-if="visibilityLevel !== visibilityOptions.PRIVATE" class="gl-line-height-28">
-          <input
-            :value="requestAccessEnabled"
-            type="hidden"
-            name="project[request_access_enabled]"
-          />
-          <input v-model="requestAccessEnabled" type="checkbox" />
-          {{ s__('ProjectSettings|Users can request access') }}
-        </label>
+        <div v-if="showAdditonalSettings" class="gl-mt-4">
+          <strong class="gl-display-block">{{ s__('ProjectSettings|Additional options') }}</strong>
+          <label
+            v-if="visibilityLevel !== visibilityOptions.PRIVATE"
+            class="gl-line-height-28 gl-font-weight-normal gl-mb-0"
+          >
+            <input
+              :value="requestAccessEnabled"
+              type="hidden"
+              name="project[request_access_enabled]"
+            />
+            <input v-model="requestAccessEnabled" type="checkbox" />
+            {{ s__('ProjectSettings|Users can request access') }}
+          </label>
+          <label
+            v-if="
+              visibilityLevel !== visibilityOptions.PUBLIC && glFeatures.enforceAuthChecksOnUploads
+            "
+            class="gl-line-height-28 gl-font-weight-normal gl-display-block gl-mb-0"
+          >
+            <input
+              :value="enforceAuthChecksOnUploads"
+              type="hidden"
+              name="project[project_setting_attributes][enforce_auth_checks_on_uploads]"
+            />
+            <input v-model="enforceAuthChecksOnUploads" type="checkbox" />
+            {{ s__('ProjectSettings|Require authentication to view media files') }}
+            <span class="gl-text-gray-500 gl-display-block gl-ml-5 gl-mt-n3">{{
+              s__('ProjectSettings|Prevents direct linking to potentially sensitive media files')
+            }}</span>
+          </label>
+        </div>
       </project-setting-row>
     </div>
     <div
diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb
index 6dd93e156c40a7..5e1d80a4b0962e 100644
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@@ -46,6 +46,10 @@ class ProjectsController < Projects::ApplicationController
     push_frontend_feature_flag(:package_registry_access_level)
   end
 
+  before_action only: :edit do
+    push_frontend_feature_flag(:enforce_auth_checks_on_uploads, @project)
+  end
+
   layout :determine_layout
 
   feature_category :projects, [
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index b3e058c059cc07..db4944ecaefb04 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -29725,6 +29725,9 @@ msgstr ""
 msgid "ProjectSettings|%{link_start}What variables can I use?%{link_end}"
 msgstr ""
 
+msgid "ProjectSettings|Additional options"
+msgstr ""
+
 msgid "ProjectSettings|Additional settings that influence how and when merges are done."
 msgstr ""
 
@@ -29938,6 +29941,9 @@ msgstr ""
 msgid "ProjectSettings|Pipelines must succeed"
 msgstr ""
 
+msgid "ProjectSettings|Prevents direct linking to potentially sensitive media files"
+msgstr ""
+
 msgid "ProjectSettings|Private"
 msgstr ""
 
@@ -29956,6 +29962,9 @@ msgstr ""
 msgid "ProjectSettings|Require an associated issue from Jira"
 msgstr ""
 
+msgid "ProjectSettings|Require authentication to view media files"
+msgstr ""
+
 msgid "ProjectSettings|Requirements"
 msgstr ""
 
-- 
GitLab