Welcome to mirror list, hosted at ThFree Co, Russian Federation.

gitlab.com/gitlab-org/gitlab-foss.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2019-08-01Fix broken internal links in docsfix-docs-lint-12-0Sean McGivern
2019-07-25Update VERSION to 12.0.4v12.0.4GitLab Release Tools Bot
2019-07-25Update CHANGELOG.md for 12.0.4GitLab Release Tools Bot
[ci skip]
2019-07-24Merge branch 'security-fix-badges-leaked-to-unauthorized-users-12-0' into ↵GitLab Release Tools Bot
'12-0-stable' Don't display badges when builds are restricted See merge request gitlab/gitlabhq!3185
2019-07-24Merge branch 'security-github-ssrf-redirect-12-0' into '12-0-stable'GitLab Release Tools Bot
Do not allow localhost url redirection in GitHub Integration See merge request gitlab/gitlabhq!3206
2019-07-24Merge branch 'security-dns-ssrf-bypass-12-0' into '12-0-stable'GitLab Release Tools Bot
Server Side Request Forgery mitigation bypass See merge request gitlab/gitlabhq!3213
2019-07-24Merge branch 'security-mr-pipeline-permissions-12-0' into '12-0-stable'GitLab Release Tools Bot
MR pipeline permissions See merge request gitlab/gitlabhq!3216
2019-07-24Merge branch 'security-60143-patch-additional-xss-issue-12.0' into '12-0-stable'GitLab Release Tools Bot
Extract SanitizeNodeLink and apply to WikiLinkFilter See merge request gitlab/gitlabhq!3222
2019-07-24Merge branch 'security-remove-take-trigger-ownership-feature-12-0' into ↵GitLab Release Tools Bot
'12-0-stable' Drop feature to take ownership of a trigger token See merge request gitlab/gitlabhq!3227
2019-07-24Merge branch ↵GitLab Release Tools Bot
'security-2873-restrict-slash-commands-to-users-who-can-log-in-12-0' into '12-0-stable' Restrict slash commands to users who can log in See merge request gitlab/gitlabhq!3238
2019-07-24Merge branch 'security-bvl-filter-mr-params-12-0' into '12-0-stable'GitLab Release Tools Bot
Filter params in MR build service See merge request gitlab/gitlabhq!3254
2019-07-24Merge branch 'security-hide_moved_issue_id-12-0' into '12-0-stable'GitLab Release Tools Bot
Do not show moved issue ids for user not authorized See merge request gitlab/gitlabhq!3260
2019-07-17Filter params in MR build serviceBob Van Landuyt
Reusing the existing `IssuableBaseService#filter_params` which uses the policies to determine what params a user can set, and which values it can be set to. This also removed the need for the seperate call to `IssuableBaseService#ensure_milestone_available`. The `Issues::BuildService` does not suffer from this because it limits the params that are assignable to the `title`, `description` and `milestone_id`.
2019-07-17Drop feature to take ownership of a trigger tokenFabio Pitino
Removing API and frontend interactions that allowed users to take ownership of a trigger token. Removed mentions from the documentation.
2019-07-16Merge branch 'sh-fix-appearance-spec-failure' into 'master'Douglas Barbosa Alexandre
Fix order-dependent spec failure in appearance_spec.rb Closes #64083 See merge request gitlab-org/gitlab-ce!30323
2019-07-15Do not show moved issue ids for user not authorizedFelipe Artur
Do not show moved issue id for users that cannot read issue
2019-07-12Restrict slash commands to users who can log inHordur Freyr Yngvason
2019-07-09Do not allow localhost url redirection in GitHub Integrationmanojmj
2019-07-08Extract SanitizeNodeLink and apply to WikiLinkFilterKerri Miller
The SanitizationFilter was running before the WikiFilter. Since WikiFilter can modify links, we could see links that _should_ be stopped by SanatizationFilter being rendered on the page. I (kerrizor) had previously addressed the bug in: https://gitlab.com/gitlab-org/gitlab-ee/commit/7bc971915bbeadb950bb0e1f13510bf3038229a4 However, an additional exploit was discovered after that was merged. Working through the issue, we couldn't simply shuffle the order of filters, due to some implicit assumptions about the order of filters, so instead we've extracted the logic that sanitizes a Nokogiri-generated Node object, and applied it to the WikiLinkFilter as well. On moving filters around: Once we start moving around filters, we get cascading failures; fix one, another one crops up. Many of the existing filters in the WikiPipeline chain seem to assume that other filters have already done their work, and thus operate on a "transform anything that's left" basis; WikiFilter, for instance, assumes any link it finds in the markdown should be prepended with the wiki_base_path.. but if it does that, it also turns `href="@user"` into `href="/path/to/wiki/@user"`, which the UserReferenceFilter doesn't see as a user reference it needs to transform into a user profile link. This is true for all the reference filters in the WikiPipeline.
2019-07-05Use MergeRequest#source_project as permissions reference for ↵drew cimino
MergeRequest#all_pipelines MergeRequest#all_pipelines fetches Ci::Pipeline records from the source project, so we should specifically check that project for permissions. This was already happening for intra-project merge requests, but in the event that the target and source projects both have private builds, we should ensure that the project permissions are respected.
2019-07-04Fix Server Side Request Forgery mitigation bypassFrancisco Javier López
When we can't resolve the hostname or it is invalid, we shouldn't even perform the request. This fix also fixes the problem the SSRF rebinding attack. We can't stub feature flags outside example blocks. Nevertheless, there are some actions that calls the UrlBlocker, that are performed outside example blocks, ie: `set` instruction. That's why we have to use some signalign mechanism outside the scope of the specs.
2019-07-01Update CHANGELOG.md for 12.0.3v12.0.3GitLab Release Tools Bot
[ci skip]
2019-07-01Merge branch 'security-support-object-storage-at-file-mover-12-0' into ↵Marin Jankovski
'12-0-stable' Support object storage at FileMover class See merge request gitlab/gitlabhq!3195
2019-07-01Support object storage at FileMover classOswaldo Ferreira
2019-06-27Update VERSION to 12.0.3GitLab Release Tools Bot
2019-06-27Update CHANGELOG.md for 12.0.3GitLab Release Tools Bot
[ci skip]
2019-06-27Don't display badges when builds are restrictedFabio Pitino
Badges were leaked to unauthorized users even when Public Builds project setting is disabled. Added guard clause to the controller to check if user can read build.
2019-06-27Merge branch 'security-notes-in-private-snippets-12-0' into '12-0-stable'GitLab Release Tools Bot
Ability to write a note in a private snippet See merge request gitlab/gitlabhq!3142
2019-06-27Merge branch 'security-fp-prevent-billion-laughs-attack-12-0' into '12-0-stable'GitLab Release Tools Bot
Prevent Billion Laughs attack See merge request gitlab/gitlabhq!3146
2019-06-27Merge branch 'security-12-0-mr-head-pipeline-leak' into '12-0-stable'GitLab Release Tools Bot
Fix MR head pipeline leak See merge request gitlab/gitlabhq!3154
2019-06-27Merge branch ↵GitLab Release Tools Bot
'security-prevent-detection-of-merge-request-template-name-12-0' into '12-0-stable' Guests can know whether merge request template name exists or not See merge request gitlab/gitlabhq!3161
2019-06-27Merge branch 'security-persist-tmp-snippet-uploads-12-0' into '12-0-stable'GitLab Release Tools Bot
Persist tmp snippet uploads at users See merge request gitlab/gitlabhq!3162
2019-06-27Merge branch 'security-59581-related-merge-requests-count-12-0' into ↵GitLab Release Tools Bot
'12-0-stable' Expose merge requests count based on user access See merge request gitlab/gitlabhq!3167
2019-06-27Merge branch 'security-DOS_issue_comments_banzai-12-0' into '12-0-stable'GitLab Release Tools Bot
Fix DOS when rendering issue/MR comments See merge request gitlab/gitlabhq!3171
2019-06-27Merge branch 'security-bvl-enforce-graphql-type-authorization-12-0' into ↵GitLab Release Tools Bot
'12-0-stable' Fix type authorizations in GraphQL See merge request gitlab/gitlabhq!3172
2019-06-27Merge branch 'security-2858-fix-color-validation-12-0' into '12-0-stable'GitLab Release Tools Bot
Fix color validation regex causing DoS See merge request gitlab/gitlabhq!3176
2019-06-27Merge branch 'security-fix-issue-59379-12-0' into '12-0-stable'GitLab Release Tools Bot
Disable Rails SQL query cache when applying service templates See merge request gitlab/gitlabhq!3179
2019-06-26Merge branch '12-0-stable-backport-deploy-board-doc' into '12-0-stable'Marin Jankovski
[Backport] Add how to migrate deployments for deploy boards See merge request gitlab-org/gitlab-ce!30059
2019-06-26Disable Rails SQL query cache when applying service templatesStan Hu
When the SQL query cache is active, the SELECT query for finding projects to apply service templates returns the same values. This causes an infinite loop because even though bulk INSERT queries are made, the cached results never reflect that progress. To fix this, we call `Project.uncached` around the query to ensure new data is retrieved. Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/63595
2019-06-26Add how to migrate deployments for deploy boardsThong Kuah
2019-06-25Update VERSION to 12.0.2v12.0.2GitLab Release Tools Bot
2019-06-25Update CHANGELOG.md for 12.0.2GitLab Release Tools Bot
[ci skip]
2019-06-25Merge branch '12-0-stable-patch-2' into '12-0-stable'Robert Speicher
Prepare 12.0.2 release See merge request gitlab-org/gitlab-ce!30045
2019-06-25Merge branch 'sh-quiet-backup-secrets-log' into 'master'Rémy Coutable
Silence backup warnings when CRON=1 in use Closes #63703 See merge request gitlab-org/gitlab-ce!30033 (cherry picked from commit d6c7d4c48db51fdc3eb479e53d40ce4358695218) ad3abd1d Silence backup warnings when CRON=1 in use
2019-06-25Merge branch 'sh-recover-ee-schema-backport-migration-failure' into 'master'Rémy Coutable
Prevent EE backport migrations from running if CE is not migrated Closes #63612 See merge request gitlab-org/gitlab-ce!30002 (cherry picked from commit 34df0b303eed0cee83d8c0ec6178d3c575a0b555) 1b063778 Prevent EE backport migrations from running if CE is not migrated
2019-06-25Merge branch 'docs/variables-doc-introduced-text' into 'master'Achilleas Pipinellis
Refactor and add version text to variable syntax See merge request gitlab-org/gitlab-ce!29964 (cherry picked from commit 4ec1720fdbf6b4fb4ae5dc91bc0f5974717e6caf) 7d93954e Refactor and add version text to variable syntax
2019-06-25Merge branch 'docs/deps-gemansium' into 'master'Mike Lewis
Remove Gemnasium dead link from docs See merge request gitlab-org/gitlab-ce!29942 (cherry picked from commit 76f49de4e772c4101bcb8df801ad9b7a78adcea7) a84a7233 Remove Gemnasium dead link from docs
2019-06-25Merge branch ↵Stan Hu
'63513-ensure-gitlab-jsoncache-includes-the-gitlab-version-in-the-cache-key' into 'master' Include the GitLab version in the cache key for Gitlab::JsonCache See merge request gitlab-org/gitlab-ce!29938 (cherry picked from commit c6f54ab12b5b276dadda0639ea647e9a2b4c1781) 94d9e335 Include the GitLab version in the cache key for Gitlab::JsonCache 1b7e7dde Add CHANGELOG entry
2019-06-25Merge branch 'sh-omit-issues-links-on-poll' into 'master'Mayra Cabrera
Omit issues links in merge request entity API response Closes #63546 See merge request gitlab-org/gitlab-ce!29917 (cherry picked from commit f47e4d025247509ab73e16c3db248b0f9ccb662c) 1b7ab11f Omit issues links in merge request entity API response
2019-06-25Merge branch 'fix-notes-emails-with-group-settings' into 'master'Douwe Maan
Fix notes email with group-level notification email Closes #63355 See merge request gitlab-org/gitlab-ce!29889 (cherry picked from commit 480eb370a477c3a230cec1ff43a71066ab5be6f9) bf73ecd7 Fix notes email with group-level notification email 8eb2d7bb Apply suggestion to spec/support/helpers/email_helpers.rb
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-05 14:15:44 +0300