Welcome to mirror list, hosted at ThFree Co, Russian Federation.

gitlab.com/gitlab-org/gitlab-foss.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/app
AgeCommit message (Collapse)Author
2019-12-31Add latest changes from gitlab-org/security/gitlab@12-4-stable-eeGitLab Bot
2019-12-06Trigger Elasticsearch indexing when public group moved to privateDylan Griffith
This fixes https://gitlab.com/gitlab-org/gitlab/issues/37766 which is caused by the fact that we leave the stale permissions data in the index after a group is moved to another group.
2019-11-26Merge branch 'security-dns-rebind-ssrf-in-slack-notifications-12-4-ce' into ↵GitLab Release Tools Bot
'12-4-stable' Use Gitlab::HTTP for all chat notifications See merge request gitlab/gitlabhq!3516
2019-11-26Merge branch 'security-33712-ce-12-4' into '12-4-stable'GitLab Release Tools Bot
Fix private comment Elasticsearch leak See merge request gitlab/gitlabhq!3524
2019-11-26Hide AWS secret on Admin Integration pageJustin Ho Tuan Duong
2019-11-26Merge branch 'security-ag-cycle-analytics-guest-permissions-12-4' into ↵GitLab Release Tools Bot
'12-4-stable' Prevent guests from seeing commits for cycle analytics See merge request gitlab/gitlabhq!3533
2019-11-26Merge branch 'security-filter-related-branches-from-activity-feed-12.4' into ↵GitLab Release Tools Bot
'12-4-stable' Related Branches Visible to Guests in Issue Activity See merge request gitlab/gitlabhq!3539
2019-11-26Merge branch 'security-2943-encrypt-plaintext-tokens-12-4' into '12-4-stable'GitLab Release Tools Bot
GitLab stores AWS, Slack, Askimet, reCaptcha tokens in plaintext See merge request gitlab/gitlabhq!3542
2019-11-26Merge branch 'security-28802-respect-fork-parent-visibility-12-4' into ↵GitLab Release Tools Bot
'12-4-stable' Check permissions before showing a forked project's source See merge request gitlab/gitlabhq!3556
2019-11-26Add latest changes from gitlab-org/gitlab@12-4-stable-eeGitLab Bot
2019-11-25Check permissions before showing a forked project's sourceNick Thomas
2019-11-25Encrypt application settings with pre and post deploymentsArturo Herrero
We had concerns about the cached values on Redis with the previous two releases strategy: First release (this commit): - Create new encrypted fields in the database. - Start populating new encrypted fields, read the encrypted fields or fallback to the plaintext fields. - Backfill the data removing the plaintext fields to the encrypted fields. Second release: - Remove the virtual attribute (created in step 2). - Drop plaintext columns from the database (empty columns after step 3). We end up with a better strategy only using migration scripts in one release: - Pre-deployment migration: Add columns required for storing encrypted values. - Pre-deployment migration: Store the encrypted values in the new columns. - Post-deployment migration: Remove the old unencrypted columns
2019-11-21Encrypt application setting tokensArturo Herrero
This is the plan to encrypt the plaintext tokens: First release (this commit): 1. Create new encrypted fields in the database. 2. Start populating new encrypted fields, read the encrypted fields or fallback to the plaintext fields. 3. Backfill the data removing the plaintext fields to the encrypted fields. Second release: 4. Remove the virtual attribute (created in step 2). 5. Drop plaintext columns from the database (empty columns after step 3).
2019-11-20Restrict branches visible to guests in Issue feedKerri Miller
Notes related to branch creation should not be shown in an issue's activity feed when the user doesn't have access to :download_code.
2019-11-20Ensure that summary items remain alignedBrandon Labuschagne
Default number of items is 3. If this is not the case, then increase the column width of the summary items to cater for 2 items plus the date filter.
2019-11-15Internalize private project minimum access levelMark Chao
Some feature allows GUEST to access only if project is not private. This method returns access level when targeting private projects.
2019-11-15Fix scope to handle private guest permissionMark Chao
Guest are blocked to certain feature when project is private, therefore the scope would filter additionally with REPORTER level.
2019-11-04Use Gitlab::HTTP for all chat notificationsHordur Freyr Yngvason
2019-11-04Add latest changes from gitlab-org/gitlab@12-4-stable-eeGitLab Bot
2019-10-25Merge branch 'security-mask-sentry-token-12-4-ce' into '12-4-stable'GitLab Release Tools Bot
Mask Sentry auth token See merge request gitlab/gitlabhq!3504
2019-10-25Merge branch 'security-remove-leaky-401-responses-12.4' into '12-4-stable'GitLab Release Tools Bot
Private/internal repository enumeration via bruteforce on a vulnerable URL See merge request gitlab/gitlabhq!3491
2019-10-25Return 404 on LFS request if project doesn't existIgor Drozdov
2019-10-24Merge branch 'security-bvl-validate-force-remove-branch-on-mrs-12-4-ce' into ↵GitLab Release Tools Bot
'12-4-stable' Only assign merge params when allowed See merge request gitlab/gitlabhq!3487
2019-10-24Merge branch 'security-wiki-rdoc-content-12-4-ce' into '12-4-stable'GitLab Release Tools Bot
Pass all wiki markup formats through our Banzai pipeline filters See merge request gitlab/gitlabhq!3485
2019-10-24Merge branch 'security-developer-transfer-project-12-4' into '12-4-stable'GitLab Release Tools Bot
Require Maintainer permission on group where project is transferred to See merge request gitlab/gitlabhq!3486
2019-10-24Merge branch 'security-open-redirect-internalredirect-12-4' into '12-4-stable'GitLab Release Tools Bot
Use the '\A' and '\z' regex anchors in `InternalRedirect` to mitigate an Open Redirect issue. See merge request gitlab/gitlabhq!3488
2019-10-24Merge branch ↵GitLab Release Tools Bot
'security-2914-labels-visible-despite-no-access-to-issues-repositories-12-4' into '12-4-stable' Labels visible despite no access to issues & repositories See merge request gitlab/gitlabhq!3489
2019-10-24Merge branch 'security-2920-fix-notes-with-label-cross-reference-12-4' into ↵GitLab Release Tools Bot
'12-4-stable' Project path reveals labels from Private project if the issue is moved to public project See merge request gitlab/gitlabhq!3490
2019-10-24Merge branch 'security-64519-circular-graphql-queries-12-4' into '12-4-stable'GitLab Release Tools Bot
Nested GraphQL query with circular relationship can cause Denial of Service See merge request gitlab/gitlabhq!3492
2019-10-24Merge branch 'security-33689-post-filter-search-results-ce-12-4' into ↵GitLab Release Tools Bot
'12-4-stable' Filter out search results based on permissions to avoid bugs leaking data See merge request gitlab/gitlabhq!3496
2019-10-24Merge branch ↵GitLab Release Tools Bot
'security-65756-ex-admin-attacker-can-comment-in-internalsecurity-65756-ex-admin-attacker-can-comment-in-internal-12-4' into '12-4-stable' Improper access control allows the attacker to comment in internal commit after they are no longer admin See merge request gitlab/gitlabhq!3497
2019-10-24Mask Sentry auth tokenRyan Cobb
This makes it so we mask Sentry's auth token. This mask only occurs in the UI.
2019-10-24Add milestone and label note types to cross refsEugenia Grieff
- Include new types in SystemNoteMetadata - Add Label and Milestone reference_pattern to Mentionable::ReferenceRegexes to be checked for cross references
2019-10-24Pick only those groups that the viewing user has access to,Aakriti Gupta
in a project members' list. Add tests for possible scenarios Re-factor and remove N + 1 queries Remove author from changelog Don't use memoisation when not needed Include users part of parents of project's group Re-factor tests Create and add users according to roles Re-use group created earlier Add incomplete test for ancestoral groups Rename method to clarify category of groups Skip pending test, remove comments not needed Remove extra line Include ancestors from invited groups as well Add specs for participants service Add more specs Add more specs use instead of Use public group owner instead of project maintainer to test owner acess Remove tests that have now been moved into participants_service_spec Use :context instead of :all Create nested group instead of creating an ancestor separately Add comment explaining doubt on the failing spec Imrpove test setup Optimize sql queries Refactor specs file Add rubocop disablement Add special case for project owners Add small refactor Add explanation to the docs Fix wording Refactor group check Add small changes in specs Add cr remarks Add cr remarks Add specs Add small refactor Add code review remarks Refactor for better database usage Fix failing spec Remove rubocop offences Add cr remarks
2019-10-23Require maintainer permission to transfer projectsmanojmj
2019-10-23Only assign merge params when allowedBob Van Landuyt
When a user updates a merge request coming from a fork, they should not be able to set `force_remove_source_branch` if they cannot push code to the source project. Otherwise developers of the target project could remove the source branch of the source project by setting this flag through the API.
2019-10-23Users without commit access cannot create notescharlieablett
2019-10-23Add #to_ability_name to Project & MilestoneDylan Griffith
This will be used later for search filtering.
2019-10-23Change Note#to_ability_name to 'note'Dylan Griffith
This is to be more consistent as there is already a :read_note policy in NotePolicy. To keep other behaviour the same we've introduced a Note#noteable_ability_name that is used anywhere this was expected.
2019-10-23Check for recursion and fail if too recursivecharlieablett
- List all overly-recursive fields - Reduce recursion threshold to 2 - Add test for not-recursive-enough query - Use reusable methods in tests - Add changelog - Set changeable acceptable recursion level - Add error check test helpers
2019-10-23Pass all wiki markup formats through pipelinesLuke Duncalfe
Previously, when the wiki page format was anything other than `markdown` or `asciidoc` the formatted content would be returned though a Gitaly call. Gitaly in turn would delegate formatting to the gitlab-gollum-lib gem, which in turn would delegate that to various gems (like RDoc for `rdoc`) and then apply some very liberal sanitization. It was too liberal! This change brings our wiki content formatting in line with how we format other markdown at GitLab, so we have a SSOT for sanitization. https://gitlab.com/gitlab-org/gitlab/issues/30540
2019-10-22Avoid #authenticate_user! in #route_not_foundKerri Miller
This method, #route_not_found, is executed as the final fallback for unrecognized routes (as the name might imply.) We want to avoid `#authenticate_user!` when calling `#route_not_found`; `#authenticate_user!` can, depending on the request format, return a 401 instead of redirecting to a login page. This opens a subtle security exploit where anonymous users will receive a 401 response when attempting to access a private repo, while a recognized user will receive a 404, exposing the existence of the private, hidden repo.
2019-10-22Fix labels finder to filter issuablesEugenia Grieff
Use project scopes to filter project labels that are visible for user
2019-10-22Use the '\A' and '\z' regex anchors in `InternalRedirect` to mitigate an ↵Joern Schneeweisz
Open Redirect issue. Fixes https://dev.gitlab.org/gitlab/gitlabhq/issues/2934 and https://gitlab.com/gitlab-org/gitlab/issues/33569
2019-10-22Add latest changes from gitlab-org/gitlab@12-4-stable-eeGitLab Bot
2019-10-01EE port: Fix private feature Elasticsearch leakMark Chao
Add spec to test different combinations. Accept string for required_minimum_access_level Allow more flexible project membership query
2019-09-26Merge branch 'security-bypass-email-verification-using-salesforce' into ↵GitLab Release Tools Bot
'12-3-stable' Prevent Bypassing Email Verification using Salesforce See merge request gitlab/gitlabhq!3395
2019-09-26Merge branch 'security-sarcila-verify-saml-request-origin-12-3' into ↵GitLab Release Tools Bot
'12-3-stable' Check that SAML identity linking validates the origin of the request See merge request gitlab/gitlabhq!3396
2019-09-26Merge branch 'security-mermaid-block' into '12-3-stable'GitLab Release Tools Bot
Only render fixed number of mermaid blocks See merge request gitlab/gitlabhq!3411
2019-09-26Merge branch ↵GitLab Release Tools Bot
'security-12717-fix-confidential-issue-assignee-visible-to-guests-12-3' into '12-3-stable' Display only participants that user has permission to see See merge request gitlab/gitlabhq!3421
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-10 19:51:30 +0300