Welcome to mirror list, hosted at ThFree Co, Russian Federation.

gitlab.com/gitlab-org/gitlab-foss.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/app
AgeCommit message (Collapse)Author
2019-09-26Merge branch 'security-sarcila-verify-saml-request-origin-12-1' into ↵GitLab Release Tools Bot
'12-1-stable' Check that SAML identity linking validates the origin of the request See merge request gitlab/gitlabhq!3376
2019-09-26Merge branch 'security-xss-mermaid-12-1' into '12-1-stable'GitLab Release Tools Bot
Gitlab XSS in markdown preview page See merge request gitlab/gitlabhq!3400
2019-09-26Merge branch ↵GitLab Release Tools Bot
'security-12717-fix-confidential-issue-assignee-visible-to-guests-12-1' into '12-1-stable' Display only participants that user has permission to see See merge request gitlab/gitlabhq!3403
2019-09-26Merge branch 'security-bypass-email-verification-using-salesforce-12-1' into ↵GitLab Release Tools Bot
'12-1-stable' Prevent Bypassing Email Verification using Salesforce See merge request gitlab/gitlabhq!3407
2019-09-26Merge branch 'security-mermaid-block-12-1' into '12-1-stable'GitLab Release Tools Bot
Only render fixed number of mermaid blocks See merge request gitlab/gitlabhq!3413
2019-09-26Merge branch ↵GitLab Release Tools Bot
'security-12718-project-milestones-disclosed-via-groups-12-1-ce' into '12-1-stable' Hide disabled project milestones in project settings on group level See merge request gitlab/gitlabhq!3416
2019-09-26Merge branch 'security-64938-dont-disclose-path-12-1-ce' into '12-1-stable'GitLab Release Tools Bot
Redirect user to root path after unsubscribing from private resource See merge request gitlab/gitlabhq!3418
2019-09-26Merge branch ↵GitLab Release Tools Bot
'security-12630-private-system-note-disclosed-in-graphql-12-1-ce' into '12-1-stable' Add policy check if cross reference system notes are accessible See merge request gitlab/gitlabhq!3428
2019-09-26Merge branch 'security-fp-stop-jobs-when-blocking-user-12-1' into '12-1-stable'GitLab Release Tools Bot
Cancel all running CI jobs when user is blocked See merge request gitlab/gitlabhq!3438
2019-09-26Merge branch 'security-cross-reference-fix-ce-12-1' into '12-1-stable'GitLab Release Tools Bot
Filter not accessible label events See merge request gitlab/gitlabhq!3442
2019-09-26Hide disabled project milestones in project settings on group levelAlexandru Croitor
2019-09-25Add policy check if cross reference system notes are accessibleAlexandru Croitor
2019-09-24Merge branch 'ss/fix-sast-failure-on-master-ee' into 'master'Kushal Pandya
Add argument to catch See merge request gitlab-org/gitlab-ee!15911
2019-09-24Filter not accessible label eventsJan Provaznik
Label events may use cross-project or cross-group references, if the projects are not accessible by user, we don't show these label events.
2019-09-24Cancel all running CI jobs when user is blockedFabio Pitino
This prevents a MITM attack where attacker could still access Git repository if any jobs were running long enough.
2019-09-20Display only participants that user has permission to seeAlexandru Croitor
2019-09-20Redirect user to root path after unsubscribing from private resourceAlexandru Croitor
If user unsubsrcribes from a resource that they no longer have access to they should not be revealed the resource path, but be redirected to app root instead. https://gitlab.com/gitlab-org/gitlab-ce/issues/64938
2019-09-19Only render fixed number of mermaid blocksRajat Jain
2019-09-18Re-add ignore_column for import columnsStan Hu
This `ignore_column` was present for a while but recently removed, but to ensure we don't get error 500s let's keep it for a while.
2019-09-16Validate that SAML requests are originated from gitlabSebastian Arcila Valenzuela
If the request wasn't initiated by gitlab we shouldn't add the new identity to the user, and instead show that we weren't able to link the identity to the user. This should fix: https://gitlab.com/gitlab-org/gitlab-ce/issues/56509
2019-09-11Add checking for email_verified keyMałgorzata Ksionek
Fix rubocop offences and add changelog Add email_verified key for feature specs Add code review remarks Add code review remarks Fix specs
2019-09-10Upgrade mermaid to prevent xss attackRajat Jain
Update mermaid to avoid xss surface area. The newer release restricts script tags to be embedded in mermaid blocks.
2019-08-28Return NO_ACCESS if user is nilPatrick Derichs
2019-08-26Merge branch 'security-hide_merge_request_ids_on_emails-12-1' into '12-1-stable'GitLab Release Tools Bot
Prevent disclosure of merge request id via email See merge request gitlab/gitlabhq!3351
2019-08-26Merge branch 'security-64711-fix-commit-todos-12-1' into '12-1-stable'GitLab Release Tools Bot
Send TODOs for comments on commits correctly See merge request gitlab/gitlabhq!3366
2019-08-26Add captcha if there are multiple failed login attemptsMałgorzata Ksionek
Add method to store session ids by ip Add new specs for storing session ids Add cleaning up records after login Add retrieving anonymous sessions Add login recaptcha setting Add new setting to sessions controller Add conditions for showing captcha Add sessions controller specs Add admin settings specs for login protection Add new settings to api Add stub to devise spec Add new translation key Add cr remarks Rename class call Add cr remarks Change if-clause for consistency Add cr remarks Add code review remarks Refactor AnonymousSession class Add changelog entry Move AnonymousSession class to lib Move store unauthenticated sessions to sessions controller Move link to recaptcha info Regenerate text file Improve copy on the spam page Change action filter for storing anonymous sessions Fix rubocop offences Add code review remarks Fix schema Update schema version
2019-08-26Merge branch 'security-12-1-enable-image-proxy' into '12-1-stable'GitLab Release Tools Bot
Use image proxy to mitigate stealing ip addresses See merge request gitlab/gitlabhq!3231
2019-08-26Merge branch 'security-61974-limit-issue-comment-size-12-1' into '12-1-stable'GitLab Release Tools Bot
Limit the size of issuable description and comments See merge request gitlab/gitlabhq!3271
2019-08-26Merge branch 'security-mr-head-pipeline-leak-12-1' into '12-1-stable'GitLab Release Tools Bot
Permission fix for MergeRequestsController#pipeline_status See merge request gitlab/gitlabhq!3278
2019-08-26Merge branch 'security-katex-dos-12-1' into '12-1-stable'GitLab Release Tools Bot
Enforce max chars and max render time in markdown math See merge request gitlab/gitlabhq!3287
2019-08-26Merge branch 'security-fix-html-injection-for-label-description-ce-12-1' ↵GitLab Release Tools Bot
into '12-1-stable' Fix HTML injection for label description See merge request gitlab/gitlabhq!3298
2019-08-26Merge branch 'security-2853-prevent-comments-on-private-mrs-12-1' into ↵GitLab Release Tools Bot
'12-1-stable' Ensure only authorised users can create notes on merge requests and issues See merge request gitlab/gitlabhq!3307
2019-08-26Merge branch 'security-epic-notes-api-reveals-historical-info-ce-12-1' into ↵GitLab Release Tools Bot
'12-1-stable' Filter out old system notes for epics in notes api endpoint response See merge request gitlab/gitlabhq!3310
2019-08-26Merge branch 'security-fix_jira_ssrf_vulnerability-12-1' into '12-1-stable'GitLab Release Tools Bot
Fix DNS rebind vulnerability for JIRA integration See merge request gitlab/gitlabhq!3311
2019-08-26Merge branch 'security-id-filter-timeline-activities-for-guests-12-1' into ↵GitLab Release Tools Bot
'12-1-stable' Add merge note type as cross reference See merge request gitlab/gitlabhq!3327
2019-08-26Merge branch 'security-project-import-bypass-12-1' into '12-1-stable'GitLab Release Tools Bot
Project visibility restriction bypass See merge request gitlab/gitlabhq!3331
2019-08-26Merge branch 'security-add-job-activity-limit-ce-12-1' into '12-1-stable'GitLab Release Tools Bot
Introduce JobActivity limit for alive jobs See merge request gitlab/gitlabhq!3342
2019-08-26Merge branch 'security-sarcila-fix-weak-session-management-12-1' into ↵GitLab Release Tools Bot
'12-1-stable' Clear reset_password_tokens when login (email or username) change See merge request gitlab/gitlabhq!3347
2019-08-26Merge branch 'security-ci-metrics-permissions-12-1' into '12-1-stable'GitLab Release Tools Bot
Restrict MergeRequests#test_reports to authenticated users with read-access on Builds See merge request gitlab/gitlabhq!3355
2019-08-26Merge branch 'security-personal-snippets-12-1' into '12-1-stable'GitLab Release Tools Bot
Add direct upload support for personal snippets See merge request gitlab/gitlabhq!3358
2019-08-23Send TODOs for comments on commits correctlyNick Thomas
At present, the TodoService uses the `:read_project` ability to decide whether a user can read a note on a commit. However, commits can have a visibility level that is more restricted than the project, so this is a security issue. This commit changes the code to use the `:read_commit` ability in this case instead, which ensures TODOs are only generated for commit notes if the users can see the commit.
2019-08-23Add direct upload support for personal snippetsJan Provaznik
2019-08-22admin_group authorization for Groups::RunnersControllerdrew cimino
- Use authorize_admin_group! instead of authorize_admin_pipeline! - Added role-based permission specs for Groups::RunnersController
2019-08-22Limit the size of issuable description and commentsAlexandru Croitor
Limiting the size of issuable description and comments to 1_000_000, which is close to ~1MB of ASCII characters, which represents 99.9% of all descriptions and comments we have in DB at the moment. This should help prevent DoS attacks when comments contain refference strings. Also this change updates regexp matching the namespaces paths by limiting the namespaces paths to Namespace::NUMBER_OF_ANCESTORS_ALLOWED, as we allow 20 levels deep groups. see https://gitlab.com/gitlab-org/gitlab-ce/issues/61974#note_191274234
2019-08-22Restrict MergeRequests#test_reports to authenticated users with read-access ↵drew cimino
on Builds
2019-08-21Prevent disclosure of merge request id via emailFelipe Artur
Do not disclosure merge request id via email for unauthorized users when closing issues.
2019-08-21Add User#will_save_change_to_login? to clear reset_password_tokensSebastian Arcila Valenzuela
Devise checks before updating any of the authentication_keys if it needs to clear the reset_password_tokens. This should fix: https://gitlab.com/gitlab-org/gitlab-ce/issues/42733 (Weak authentication and session management)
2019-08-20Add active_jobs_limit to plans tableFabio Pitino
This is a port from EE changes where we introduce a new limit for Plan model. https://dev.gitlab.org/gitlab/gitlab-ee/merge_requests/1182
2019-08-15Add support for using a Camo proxy serverBrett Walker
User images and videos will get proxied through the Camo server in order to keep malicious sites from collecting the IP address of users.
2019-08-15Fix project import restricted visibility bypassGeorge Koltsov
Add Gitlab::VisibilityLevelChecker that verifies selected project visibility level (or overridden param) is not restricted when creating or importing a project
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-21 09:15:16 +0300