SONAR-10134 show now fails when using id and different organization

2 files changed, 31 insertions, 1 deletions

diff --git a/server/sonar-server/src/main/java/org/sonar/server/qualitygate/ws/ShowAction.java b/server/sonar-server/src/main/java/org/sonar/server/qualitygate/ws/ShowAction.java
index ea968562013..b6a08d62f45 100644
--- a/server/sonar-server/src/main/java/org/sonar/server/qualitygate/ws/ShowAction.java
+++ b/server/sonar-server/src/main/java/org/sonar/server/qualitygate/ws/ShowAction.java
@@ -105,7 +105,7 @@ public class ShowAction implements QualityGatesWsAction {
       return checkFound(dbClient.qualityGateDao().selectByOrganizationAndName(dbSession, organization, name), "No quality gate has been found for name %s", name);
     }
     if (id != null) {
-      return qualityGateFinder.getById(dbSession, id);
+      return qualityGateFinder.getByOrganizationAndId(dbSession, organization, id);
     }
     throw new IllegalArgumentException("No parameter has been set to identify a quality gate");
   }
diff --git a/server/sonar-server/src/test/java/org/sonar/server/qualitygate/ws/ShowActionTest.java b/server/sonar-server/src/test/java/org/sonar/server/qualitygate/ws/ShowActionTest.java
index beff812603e..d5ee72e1cd1 100644
--- a/server/sonar-server/src/test/java/org/sonar/server/qualitygate/ws/ShowActionTest.java
+++ b/server/sonar-server/src/test/java/org/sonar/server/qualitygate/ws/ShowActionTest.java
@@ -347,4 +347,34 @@ public class ShowActionTest {
       .setParam("organization", "Unknown")
       .execute();
   }
+
+  @Test
+  public void fail_when_quality_gate_belongs_to_another_organization() {
+    OrganizationDto organization = db.organizations().insert();
+    OrganizationDto otherOrganization = db.organizations().insert();
+    QGateWithOrgDto qualityGate = db.qualityGates().insertQualityGate(otherOrganization);
+
+    expectedException.expect(NotFoundException.class);
+    expectedException.expectMessage(format("No quality gate has been found for name %s", qualityGate.getName()));
+
+    ws.newRequest()
+      .setParam("name", qualityGate.getName())
+      .setParam("organization", organization.getKey())
+      .execute();
+  }
+
+  @Test
+  public void fail_when_quality_gate_belongs_to_another_organization_using_id_parameter() {
+    OrganizationDto organization = db.organizations().insert();
+    OrganizationDto otherOrganization = db.organizations().insert();
+    QGateWithOrgDto qualityGate = db.qualityGates().insertQualityGate(otherOrganization);
+
+    expectedException.expect(NotFoundException.class);
+    expectedException.expectMessage(format("No quality gate has been found for id %s in organization %s", qualityGate.getId(), organization.getName()));
+
+    ws.newRequest()
+      .setParam("id", qualityGate.getId().toString())
+      .setParam("organization", organization.getKey())
+      .execute();
+  }
 }