Age | Commit message (Collapse) | Author |
|
|
|
|
|
|
|
Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.
Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.
|
|
- Need to pass in a `page_slug` to the filter, so it can rewrite based
on the current page (all links are rewritten to the level of the app root).
- The earlier `markdown_preview` endpoint was at the level of the wiki.
We need to know the current page (for rewriting, as above), so this
commit moves the endpoint to the level of a wiki page.
- Fix all tests
|
|
This splits the Markdown rendering and reference extraction phases into
two distinct code bases. The reference extraction phase no longer relies
on the html-pipeline Gem (and any related code) and allows for
extracting of references from multiple HTML nodes in a single pass. This
means that if you want to extract user references from 200 comments you
no longer need to run 200 times N number of queries, instead only a
handful of queries may be needed.
|
|
Closes #15527.
Signed-off-by: Rémy Coutable <remy@rymai.me>
|
|
|
|
|
|
update changelog
|
|
|
|
|
|
|
|
Closes #2104
Closes #1751
Closes #1592
Closes https://github.com/gitlabhq/gitlabhq/issues/9399
|
|
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
|
|
write_ was renamed to create_
modify_ was renamed to update_
So now in update action we have next code
def create
can?(current_user, :create_issue, @issue)
end
def update
can?(current_user, :update_issue, @issue)
end
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
|
|
Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>
|
|
Closes #1363
|
|
|
|
|
|
Make the following changes to deal with new behavior in Rails 4.1.2:
* Use nested resources to avoid slashes in arguments to path helpers.
|
|
|
|
From #6168.
|
|
|
|
|
|
|
|
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
|
|
|