Welcome to mirror list, hosted at ThFree Co, Russian Federation.

gitlab.com/gitlab-org/gitlab-foss.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
path: root/lib
AgeCommit message (Collapse)Author
2019-08-26Avoid exposing unaccessible repo data upon GFM processingOswaldo Ferreira
When post-processing relative links to absolute links RelativeLinkFilter didn't take into consideration that internal repository data could be exposed for users that do not have repository access to the project. This commit solves that by checking whether the user can `download_code` at this repository, avoiding any processing of this filter if the user can't. Additionally, if we're processing for a group ( no project was given), we check if the user can read it in order to expand the href as an extra. That doesn't seem necessarily a breach now, but an extra check doesn't hurt as after all the user needs to be able to `read_group`.
2019-08-26Add captcha if there are multiple failed login attemptsMałgorzata Ksionek
Add method to store session ids by ip Add new specs for storing session ids Add cleaning up records after login Add retrieving anonymous sessions Add login recaptcha setting Add new setting to sessions controller Add conditions for showing captcha Add sessions controller specs Add admin settings specs for login protection Add new settings to api Add stub to devise spec Add new translation key Add cr remarks Rename class call Add cr remarks Change if-clause for consistency Add cr remarks Add code review remarks Refactor AnonymousSession class Add changelog entry Move AnonymousSession class to lib Move store unauthenticated sessions to sessions controller Move link to recaptcha info Regenerate text file Improve copy on the spam page Change action filter for storing anonymous sessions Fix rubocop offences Add code review remarks Fix schema Update schema version
2019-08-26Merge branch 'security-12-1-enable-image-proxy' into '12-1-stable'GitLab Release Tools Bot
Use image proxy to mitigate stealing ip addresses See merge request gitlab/gitlabhq!3231
2019-08-26Merge branch 'security-61974-limit-issue-comment-size-12-1' into '12-1-stable'GitLab Release Tools Bot
Limit the size of issuable description and comments See merge request gitlab/gitlabhq!3271
2019-08-26Merge branch 'security-epic-notes-api-reveals-historical-info-ce-12-1' into ↵GitLab Release Tools Bot
'12-1-stable' Filter out old system notes for epics in notes api endpoint response See merge request gitlab/gitlabhq!3310
2019-08-26Merge branch 'security-fix_jira_ssrf_vulnerability-12-1' into '12-1-stable'GitLab Release Tools Bot
Fix DNS rebind vulnerability for JIRA integration See merge request gitlab/gitlabhq!3311
2019-08-26Merge branch 'security-project-import-bypass-12-1' into '12-1-stable'GitLab Release Tools Bot
Project visibility restriction bypass See merge request gitlab/gitlabhq!3331
2019-08-26Merge branch 'security-add-job-activity-limit-ce-12-1' into '12-1-stable'GitLab Release Tools Bot
Introduce JobActivity limit for alive jobs See merge request gitlab/gitlabhq!3342
2019-08-26Merge branch 'security-personal-snippets-12-1' into '12-1-stable'GitLab Release Tools Bot
Add direct upload support for personal snippets See merge request gitlab/gitlabhq!3358
2019-08-23Re-escape whole HTML content instead of only matchJan Provaznik
When we un-escape HTML text to find references in it, we should then re-escape the whole text again, not only found matches. Because we replace matches with milestone/label links (which contain HTML tags we don't want to escape again), we re-escape HTML text with placeholders instead of these links and then replace placeholders in the escaped text.
2019-08-23Add direct upload support for personal snippetsJan Provaznik
2019-08-22Limit the size of issuable description and commentsAlexandru Croitor
Limiting the size of issuable description and comments to 1_000_000, which is close to ~1MB of ASCII characters, which represents 99.9% of all descriptions and comments we have in DB at the moment. This should help prevent DoS attacks when comments contain refference strings. Also this change updates regexp matching the namespaces paths by limiting the namespaces paths to Namespace::NUMBER_OF_ANCESTORS_ALLOWED, as we allow 20 levels deep groups. see https://gitlab.com/gitlab-org/gitlab-ce/issues/61974#note_191274234
2019-08-20Add active_jobs_limit to plans tableFabio Pitino
This is a port from EE changes where we introduce a new limit for Plan model. https://dev.gitlab.org/gitlab/gitlab-ee/merge_requests/1182
2019-08-15Add support for using a Camo proxy serverBrett Walker
User images and videos will get proxied through the Camo server in order to keep malicious sites from collecting the IP address of users.
2019-08-15Fix project import restricted visibility bypassGeorge Koltsov
Add Gitlab::VisibilityLevelChecker that verifies selected project visibility level (or overridden param) is not restricted when creating or importing a project
2019-08-09Filter out old system notes for epicsPatrick Derichs
2019-08-08Fix DNS rebind vulnerability for JIRA integrationFelipe Artur
Uses Gitlab::HTTP for JIRA requests instead of Net::Http. Gitlab::Http comes with some built in SSRF protections.
2019-08-05Merge branch 'leipert-improve-ansi2html' into 'master'Fatih Acet
Improve job log rendering performance See merge request gitlab-org/gitlab-ce!31262 (cherry picked from commit eb2d4adf38726da62f62e850d181cedf12c64c5e) 6b45d85e Prevent empty classes in ansi2html conversion 5366c89b Fix deep DOM tree problem in ansi2html d1f4d8c7 Improve size of rendered job trace
2019-08-05Merge branch 'patch-72' into 'master'Thong Kuah
Set DOCKER_TLS_CERTDIR in CI job templates See merge request gitlab-org/gitlab-ce!31201 (cherry picked from commit 82ce29d32fc8d98571ee43a6d348f89bdecfa9c0) 8d4f53a0 Set DOCKER_TLS_CERTDIR in CI job templates 25486f40 Merge remote-tracking branch 'upstream/master' into patch-72 2535575c Add changelog.
2019-08-05Merge branch 'osw-avoid-errors-due-to-concurrent-calls' into 'master'Douwe Maan
Add exclusive lease to mergeability check process See merge request gitlab-org/gitlab-ce!31082 (cherry picked from commit c017dc578dc78729050792d22b449ce0529479cf) f4cd926c Add exclusive lease to mergeability check process
2019-07-30Merge branch 'sh-fix-gitaly-access-control' into 'master'Douglas Barbosa Alexandre
Fix exception handling in Gitaly autodetection Closes #65328 See merge request gitlab-org/gitlab-ce!31285 (cherry picked from commit d92a8c1a5f9b061a10140239bed44b432b28abdf) 3b76d298 Fix exception handling in Gitaly autodetection
2019-07-30Merge branch 'dm-submodule-links-nil' into 'master'Nick Thomas
Fix error rendering submodules in MR diffs when there is no .gitmodules See merge request gitlab-org/gitlab-ce!31162 (cherry picked from commit 55f99e930e1c147ec191a234ff4881ea7e70ea61) cfef1e8e Fix error rendering submodules in MR diffs when there is no .gitmodules
2019-07-30Merge branch 'sh-support-docker-oci-images' into 'master'Dmitriy Zaporozhets
Support Docker OCI images Closes gitlab-ee#12877 and #58685 See merge request gitlab-org/gitlab-ce!31127 (cherry picked from commit 29f2903d161c2b93468a997f704a81adebcc9f58) a4011606 Support Docker OCI images
2019-07-30Merge branch '65019-job-templates-dind-tls-fix' into 'master'Thong Kuah
Set DOCKER_TLS_CERTDIR in CI job templates See merge request gitlab-org/gitlab-ce!31080 (cherry picked from commit 8768e295c3474cb3fcee9afe3b7e9a2ac1431b50) c472bec5 Set DOCKER_TLS_CERTDIR in CI job templates
2019-07-30Merge branch '65019-auto-devops-dind-tls-fix' into 'master'Thong Kuah
Set DOCKER_TLS_CERTDIR in Auto Dev-Ops CI template See merge request gitlab-org/gitlab-ce!31078 (cherry picked from commit a842c3882c4b47cc8b384fbd84be5643dacc7269) af88ccfa Set DOCKER_TLS_CERTDIR in Auto Dev-Ops CI template
2019-07-30Merge branch 'alhashash1-12-1-stable-patch-67177' into 'master'Stan Hu
Fix incorrect web server selection parameter in init.d script Closes #64802 and #65008 See merge request gitlab-org/gitlab-ce!31076 (cherry picked from commit 0a2bbc9267e5aca220cda17f13e6f62bae7f1f1b) 2bc43c44 Fix incorrect web server parameter in init.d script
2019-07-30Merge branch 'optimise-import-performance' into 'master'Stan Hu
Optimise import performance Closes #64924 See merge request gitlab-org/gitlab-ce!31045 (cherry picked from commit 0d538e44aff066372ecd9d10ac6786681bc347c9) 8d1e97fc Optimise import performance
2019-07-24Merge branch 'security-dns-ssrf-bypass-12-1' into '12-1-stable'GitLab Release Tools Bot
Server Side Request Forgery mitigation bypass See merge request gitlab/gitlabhq!3220
2019-07-24Merge branch 'security-60143-patch-additional-xss-issue-12.1' into '12-1-stable'GitLab Release Tools Bot
Extract SanitizeNodeLink and apply to WikiLinkFilter See merge request gitlab/gitlabhq!3221
2019-07-24Merge branch 'security-github-ssrf-redirect-12-1' into '12-1-stable'GitLab Release Tools Bot
Do not allow localhost url redirection in GitHub Integration See merge request gitlab/gitlabhq!3223
2019-07-24Merge branch 'security-remove-take-trigger-ownership-feature-12-1' into ↵GitLab Release Tools Bot
'12-1-stable' Drop feature to take ownership of a trigger token See merge request gitlab/gitlabhq!3225
2019-07-19Merge branch 'sh-fix-gitaly-server-info-cache' into 'master'Mayra Cabrera
Fix Gitaly auto-detection caching Closes #64802 See merge request gitlab-org/gitlab-ce!30954
2019-07-18Merge branch 'ci_default_git_depth_only' into 'master'Douglas Barbosa Alexandre
API: Allow changing only ci_default_git_depth See merge request gitlab-org/gitlab-ce!30888 (cherry picked from commit 0854f18352e72c2bcc0beca601d1ea48b490d1be) 0f585d0d API: Allow changing only ci_default_git_depth
2019-07-18Refactor RedisCounter and WebIdeCommitsCounterFrancisco Javier López
This MR refactor RedisCounter and WebIdeCommitsCounter to be reused by other components.
2019-07-18Merge branch 'jc-wrap-rugged-calls-with-disk-access' into 'master'Stan Hu
Wrap rugged calls with access disk block See merge request gitlab-org/gitlab-ce!30592
2019-07-17Merge branch 'issue-64645-asciidoctor-footnote-links' into 'master'Nick Thomas
Preserve footnote link ids Closes #64645 See merge request gitlab-org/gitlab-ce!30790
2019-07-17Added submodule links to Submodule type in GraphQL APIIgor
This is part of migration of Folder View to Vue
2019-07-17Fix wrong pages access level defaultVladimir Shushlin
- Set access level in before_validation hook - Add post migration for updating existing project_features
2019-07-17CE port of "Move external authorization service API management to EE"Imre Farkas
EE MR: https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/14598
2019-07-17Fetch latest link in the description for zoom link, add more tests and ↵Rajendra kadam
remove frontend spec unnecessary tests
2019-07-17Preserve footnote link idsGuillaume Grossetie
2019-07-17Propagate PIP index URLFabien Catteau
Propagate PIP_INDEX_URL, PIP_EXTRA_INDEX_URL to the dependency-scanning Docker image to support Python projects depending on custom Pypi registries. These variables will be consumed by the gemnasium-python analyzer.
2019-07-17Merge branch '12800-read-and-write-user-admin-notes-via-api-ce' into 'master'Stan Hu
CE Backport: Read and write User "Admin notes" via API See merge request gitlab-org/gitlab-ce!30775
2019-07-16Wrap rugged calls with access disk blockJohn Cai
Whenever we use the rugged implementation, we are going straight to disk so we want to bypass the disk access check.
2019-07-16Merge branch 'jc-fix-rugged-feature-flag-rake' into 'master'Stan Hu
Add unset_rugged rake task Closes #64441 See merge request gitlab-org/gitlab-ce!30636
2019-07-16Rename Redactor classes to ReferenceRedactorSarah Yasonik
2019-07-16CE: Read and write User "Admin notes" via APImanojmj
This change adds the ability to read and write admin notes for a user via the USER API
2019-07-16Extract SanitizeNodeLink and apply to WikiLinkFilterKerri Miller
The SanitizationFilter was running before the WikiFilter. Since WikiFilter can modify links, we could see links that _should_ be stopped by SanatizationFilter being rendered on the page. I (kerrizor) had previously addressed the bug in: https://gitlab.com/gitlab-org/gitlab-ee/commit/7bc971915bbeadb950bb0e1f13510bf3038229a4 However, an additional exploit was discovered after that was merged. Working through the issue, we couldn't simply shuffle the order of filters, due to some implicit assumptions about the order of filters, so instead we've extracted the logic that sanitizes a Nokogiri-generated Node object, and applied it to the WikiLinkFilter as well. On moving filters around: Once we start moving around filters, we get cascading failures; fix one, another one crops up. Many of the existing filters in the WikiPipeline chain seem to assume that other filters have already done their work, and thus operate on a "transform anything that's left" basis; WikiFilter, for instance, assumes any link it finds in the markdown should be prepended with the wiki_base_path.. but if it does that, it also turns `href="@user"` into `href="/path/to/wiki/@user"`, which the UserReferenceFilter doesn't see as a user reference it needs to transform into a user profile link. This is true for all the reference filters in the WikiPipeline.
2019-07-16Refactored WebIdeCommitsCount classFrancisco Javier López
We're adding more redis base counters to the web ide and other classes. We're refactoring this class in other to use the logic in other places.
2019-07-16Merge branch 'remove-support-for-legacy-pipeline-triggers' into 'master'Kamil Trzciński
Remove support for legacy pipeline triggers Closes #30231 See merge request gitlab-org/gitlab-ce!30133
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-20 00:39:06 +0300