| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
|
|
|
|
Upgrade to Ruby 2.4.4
See merge request gitlab-org/gitlab-ce!19055
|
|
This gem (https://gitlab.com/gitlab-org/grape-path-helpers) makes a number of changes:
1. Brings in @mdelaossa's changes in https://github.com/reprah/grape-route-helpers/pull/21
2. Fixes some broken specs and code for Grape 1.0+
3. Optimizes the generation of paths by bringing in @dblessing's
HashWithIndifferentAccess changes in https://gitlab.com/gitlab-org/gitlab-ce/issues/45718#note_70123793
Closes #45718
|
|
Fixes that make this work:
* A change in Ruby (https://github.com/ruby/ruby/commit/ce635262f53b760284d56bb1027baebaaec175d1)
requires passing in the exact required length for OpenSSL keys and IVs.
* Ensure the secrets.yml is generated before any prepended modules are
loaded. This is done by renaming the `secret_token.rb` initializer to
`01_secret_token.rb`, which is a bit ugly but involves the least impact on
other files.
|
|
Given the settings initializer creates Gitaly Storage Settings objects
already, the calls to path can be moved to that initializer.
|
|
|
|
|
|
Bring Object Storage to CE
Closes #4171, #4163, #3370, #2841, and #29203
See merge request gitlab-org/gitlab-ce!17358
|
|
|
|
Resolve ""Support private HTTPS urls for object storage""
Closes #4879
See merge request gitlab-org/gitlab-ee!4475
|
|
Bringing in https://github.com/reprah/grape-route-helpers/pull/21 as a
monkey patch since the grape-route-helpers project seems to be abandoned
|
|
If using gravatar.com, both plain_url and ssl_url in settings are now
served via HTTPS. Make this the default.
|
|
|
|
|
|
Instead of from the configuration file
|
|
|
|
Closes #37789
|
|
|
|
|
|
|
|
|
|
Signed-off-by: Rémy Coutable <remy@rymai.me>
|
|
services: true, no_db: true, api: true
Signed-off-by: Rémy Coutable <remy@rymai.me>
|
|
|
|
This instrumentation isn't needed strictly for performance measurements, but
just to see which controller actions call this method at all. See
<https://gitlab.com/gitlab-org/gitlab-ce/issues/30224#note_32306159> for more
details.
|
|
|
|
Besides improving the error message to specify what exactly you
need to do to solve the error, we now don't skip all storage
validations on the test environment, so that you also get a nice error
message if you're running tests. Now if conditions are met to skip
valitaions (test env or env variable) we still make sure the settings
_look_ sane, we just skip verifying the paths exists and meet the given
conditions.
|
|
Update storage settings to allow extra values per shard
See merge request !9597
|
|
|
|
|
|
|
|
This will be necessary when adding gitaly settings. This version
doesn't make any functional changes, but allows us to include this
breaking change in 9.0 and add the needed extra settings in the future
with backwards compatibility
|
|
This makes sure that Gitlab::Metrics::RackMiddleware is added before
Gitlab::EtagCaching::Middleware.
|
|
|
|
An empty file in one of the instrumented directories will cause the app
to fail to start when metrics are enabled. Metrics aren't enabled by
default in development or test.
We could handle the empty file case explicitly, but a file could still
not define the constant it is expected to, so instead run the
initializer manually in a spec and check that it succeeds.
|
|
|
|
If an environment variable exists for secret_key_base, use that -
always. But don't save it to secrets.yml.
Also ensure that we never write to secrets.yml if there's a non-blank
value there.
|
|
Move the last secret from .secret to config/secrets.yml, and delete
.secret if it exists.
|
|
.secret stores the secret token used for both encrypting login cookies
and for encrypting stored OTP secrets. We can't rotate this, because
that would invalidate all existing OTP secrets.
If the secret token is present in the .secret file or an environment
variable, save it as otp_key_base in secrets.yml. Now .secret can be
rotated without invalidating OTP secrets.
If the secret token isn't present (initial setup), then just generate a
separate otp_key_base and save in secrets.yml.
Update the docs to reflect that secrets.yml needs to be retained past
upgrades, but .secret doesn't.
|
|
|
|
Certain reverse proxies can send invalid IP addresses in the X-Forwarded-For header
For example, Apache can send (null).
Closes #20194
|
|
Storage path are not created until `TestEnv.init`, so we must skip
their validation on initialization.
|
|
|
|
|
|
Make Rack::Request use our trusted proxies when filtering IP addresses
## What does this MR do?
This allows us to control the trusted proxies while deployed in a private network.
## Are there points in the code the reviewer needs to double check?
If we want to limit what is impacted, we can do this specifically for the rack_attack request object.
## Why was this MR needed?
Normally Rack::Request will trust all private IPs as trusted proxies, which can cause problems if your users are connection on you network via private IP ranges.
Normally in a rails app this is handled by action_dispatch request, but rack_attack is specifically using the Rack::Request object instead.
## What are the relevant issue numbers?
Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17550
## Does this MR meet the acceptance criteria?
- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] ~~[Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)~~
- [ ] ~~API support added~~
- Tests
- [x] Added for this feature/bug
- [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [ ] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)
\cc @stanhu
See merge request !4958
|
|
This allows us to control the trusted proxies while deployed in a private network. Normally Rack::Request will trust all private IPs as trusted proxies, which can caue problems if your users are connection on you network via private IP ranges.
Normally in a rails app this is handled by action_dispatch request, but rack_attack is specifically using the Rack::Request object instead.
|
|
|
