| Age | Commit message (Collapse) | Author |
|---|
|
Whitelist or fix additional `Gitlab/PublicSend` cop violations
See merge request !13467
|
|
|
|
An upcoming update to rubocop-gitlab-security added additional
violations.
|
|
We had a lot of copied and pasted code, when the different elements were very
small and easy to get wrong.
|
|
Group milestones can only be referred to by name, not IID. They also do not
support cross-project references.
|
|
This bails out of `cacheless_render` immediately unless the provided
text is present, since there's no point.
This is a slight improvement in our test performance. Across the
creation of 1,000 `Namespace` records, which caches the `description`
field and which is blank by default in its factory, this saves about
four seconds, which... sure. Why not.
|
|
|
|
|
|
|
|
|
|
Fix markdown preview tooltip cut off issue
Closes #31748
See merge request !12367
|
|
|
|
|
|
|
|
|
|
|
|
Fix visibility when referencing snippets
See merge request !2101
|
|
The /unsubscribe slash command means that we check if the current user is
subscribed to the issuable without having an explicit subscription. That means
that we use the UserParser to find references to them in the notes.
The UserParser (and all parsers inheriting from BaseParser) use RequestStore to
cache ActiveRecord objects, so that we don't need to load the User object each
time, if we're parsing references a bunch of times in the same request.
However, it was always returning _all_ of the previously cached items, not just
the ones matching the IDs passed. This would mean that we did two runs through
with UserParser if you were mentioned in a comment, and then mentioned someone
else in your comment while using /unsubscribe:
1. Because /unsubscribe was used, we see if you were mentioned in any comments.
2. Because you mentioned someone, we find them - but we would also get back your
user, even if you didn't mention yourself. This would have the effect of
creating a mention or directly addressed todo for yourself incorrectly.
The fix is simple: only return values from the cache matching the IDs passed.
|
|
Fix LaTeX formatting for AsciiDoc wiki
Closes #29852
See merge request !11212
|
|
|
|
|
|
(security-9-1) Add correct `rel` attributes to external links when rendering markdown
See merge request !2097
|
|
(security-9-1) Render asciidoc & other markup using banzai in a pipeline
See merge request !2098
|
|
|
|
N in this case is low, as it's the number of distinct projects referenced from
MRs, rather than the number of MRs referenced (issues use their own
optimization). Still, on issues or MRs which are often referenced from MRs, it
will save a few queries.
|
|
|
|
|
|
|
|
Closes #31280
|
|
|
|
|
|
|
|
Do not append issuable state to links with custom anchor
Closes #30916
See merge request !10782
|
|
Fix PlantUML integration in GFM
Closes #30557
See merge request !10651
|
|
Closes #30916
Change the presentation from [closed] to (closed)
|
|
Fixes #30557
Use "lang" attribute instead of "class" in PlantumlFilter.
|
|
Closes #30964
|
|
Closes #30972
|
|
Closes #30874.
Ignore nodes with no children.
Append directly to the node instead of the last child of the node
to avoid inheriting formatting from the last child
|
|
|
|
Example: for issues that are closed, the links will now show '[closed]'
following the issue number. This is done as post-process after the markdown has
been loaded from the cache as the status of the issue may change between
the cache being populated and the content being displayed.
In order to avoid N+1 queries problem when rendering notes ObjectRenderer
populates the cache of referenced issuables for all notes at once,
before the post processing phase.
As a part of this change, the Banzai BaseParser#grouped_objects_for_nodes
method has been refactored to return a Hash utilising the node itself as the
key, since this was a common pattern of usage for this method.
|
|
Remove class from SanitizationFilter whitelist
See merge request !2079
|
|
Make user mentions case-insensitive
Closes #24493
See merge request !10285
|
|
|
|
Signed-off-by: Rémy Coutable <remy@rymai.me>
|
|
Signed-off-by: Rémy Coutable <remy@rymai.me>
|
|
Use the same approach in Banzai::Filter::MergeRequestReferenceFilter
as we do with issues.
Signed-off-by: Rémy Coutable <remy@rymai.me>
|
|
Adds rel="noopener noreferrer" to all links with target="_blank"
See merge request !2071
|
|
|
|
|
