| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
A nonce-based Content-Security-Policy thwarts XSS attacks by allowing
inline JavaScript to execute if the script nonce matches the header
value. Rails 5.2 supports nonce-based Content-Security-Policy headers,
so provide configuration to enable this and make it work.
To support this, we need to change all `:javascript` HAML filters to the
following form:
```
= javascript_tag nonce: true do
:plain
...
```
We use `%script` throughout our HAML to store JSON and other text, but
since this doesn't execute, browsers don't appear to block this content
from being used and require the nonce value to be present.
|
|
|
|
|
|
|
|
Part of single codebase changes.
|
|
|
|
Compile highlight CSS separately
Move highlight-specific mixins out of mixins.scss
Rename solarized themes to match theme name as this was a smaller
change than changing all instances to snake_case
|
|
Signed-off-by: Rémy Coutable <remy@rymai.me>
|
|
|
|
|
|
the initial reason for this change was that graphicsmagick does not
support writing to ico files. this fact lead to a chain of changes:
1. use png instead of ico (browser support is good enough)
2. render the overlays on the client using the canvas API. this way we
only need to store the original favion and generate the overlay versions
dynamically.
this change also enables (next step) to simplify the handling of the
stock favicons as well, as we don't need to generate all the versions
upfront.
|
|
|
|
|
|
|
|
Automatically Generate Webpack Entry Points
See merge request gitlab-org/gitlab-ce!16865
|
|
including/extending it
|
