Age | Commit message (Collapse) | Author |
|
|
|
|
|
|
|
|
|
In Ruby 2.4, `URI.join("http://test//", "a").to_s` will
remove the double slash, however it's not the case in
Ruby 2.5. Using chomp should work better for the intention,
as we're not trying to allow things like ../ or / paths
resolution.
This helper method append path to host, making sure
there's one single slash as path separator.
|
|
|
|
|
|
Fix https://gitlab.com/gitlab-org/gitlab-ee/issues/4474
Conflicts:
db/schema.rb
ee/app/controllers/ee/admin/application_settings_controller.rb
ee/app/helpers/ee/application_settings_helper.rb
ee/app/models/ee/application_setting.rb
ee/app/models/license.rb
ee/app/views/layouts/service_desk.html.haml
ee/app/views/notify/approved_merge_request_email.html.haml
ee/app/views/notify/service_desk_new_note_email.text.erb
ee/app/views/notify/service_desk_thank_you_email.text.erb
ee/app/views/notify/unapproved_merge_request_email.html.haml
ee/lib/ee/api/entities.rb
ee/spec/controllers/admin/application_settings_controller_spec.rb
ee/spec/models/application_setting_spec.rb
ee/spec/requests/api/settings_spec.rb
lib/api/settings.rb
spec/mailers/previews/notify_preview.rb
|
|
|
|
'41293-fix-command-injection-vulnerability-on-system_hook_push-queue-through-web-hook' into 'security-10-3'
Don't allow line breaks on HTTP headers
See merge request gitlab/gitlabhq!2277
(cherry picked from commit 7fc0a6fc096768a5604d6dd24d7d952e53300c82)
073b8f9c Don't allow line breaks on HTTP headers
|
|
|
|
|
|
|
|
|
|
|
|
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5734#note_14056642
|
|
|
|
|
|
|
|
This reverts commit b33d4bc2f1d26ee3526b9d7f530f468a9d5b5a5e.
|
|
This reverts commit 0b1084a4538bc46684c8620410988d3b1093e7ab.
|
|
It pollutes the test output too much.
|