Age | Commit message (Collapse) | Author |
|
Use UntrustedRegexp for CI refs matching
See merge request gitlab/gitlabhq!3007
|
|
Check label_ids parent when updating issue board
See merge request gitlab/gitlabhq!3036
|
|
'11-8-stable'
Fix XSS in resolve conflicts form
See merge request gitlab/gitlabhq!2987
|
|
Fix related branches visible in issues for guests
See merge request gitlab/gitlabhq!3019
|
|
As they do not have a permission to read git tag
|
|
- labels have to be in the same project/group
as an issuable
|
|
Guest user of a project should not see branches
|
|
When executing quick actions, this limits the `commands_changes`
response to only those used by the frontend
|
|
This makes ref validation to use always `UntrustedRegexp`.
This also splits the existing RubySyntax into separate
class.
|
|
The issue arose when the branch name contained Vue template
JavaScript. The fix is to use `v-pre` which disables Vue
compilation in a template.
|
|
Update group policy to reflect all the requirements
See merge request gitlab-org/gitlab-ce!25854
|
|
|
|
Freeze date in merge request status view spec
See merge request gitlab-org/gitlab-ce!25671
(cherry picked from commit c994484d17d6a6da929f6a52f1b64dc15c38835c)
a05aba61 Freeze date in merge request status view spec
|
|
Fix method to mark a project repository as writable
See merge request gitlab-org/gitlab-ce!25546
(cherry picked from commit a8a02387a7ea5c5a4a6f733a043adf2b1f907e3c)
df044542 Fix project set_repository_writable!
|
|
Allow `:read_list` when `:read_group` is allowed
Closes #58149
See merge request gitlab-org/gitlab-ce!25524
(cherry picked from commit 61c1509cc992959ac5021d10825d5dbf9dd2c091)
b81e7c52 Enable `:read_list` when `:read_group` is enabled
|
|
Properly handle multiple X-Forwarded-For addresses in runner IP
Closes #58103
See merge request gitlab-org/gitlab-ce!25511
(cherry picked from commit dbf0a92292dd054843d28ec27d52222418400ca5)
d03b7bb1 Properly handle multiple X-Forwarded-For addresses in runner IP
|
|
'57579-gitlab-project-import-fails-sidekiq-undefined-method-import_jid' into 'master'
Resolve "Gitlab Project import fails: sidekiq undefined method import_jid"
Closes #57579
See merge request gitlab-org/gitlab-ce!25239
(cherry picked from commit c06ebe511700f25a61b4dfaa518fbed7667c6876)
401a3bca Fix import_jid error on project import
|
|
Display only labels and assignees of issues
visible by the currently logged user
Display only issues visible to user in the burndown chart
|
|
|
|
'11-8-stable'
Filter impersonated sessions from active sessions and remove ability to revoke session
See merge request gitlab/gitlabhq!2981
|
|
'11-8-stable'
Forbid creating discussions for users with restricted access
See merge request gitlab/gitlabhq!2890
|
|
Check issue milestone availability
See merge request gitlab/gitlabhq!2904
|
|
Prevent Releases links API to leak tag existence
See merge request gitlab/gitlabhq!2908
|
|
Disable issue board policies when issues are disabled
See merge request gitlab/gitlabhq!2910
|
|
Show only MRs visible to user on milestone detail
See merge request gitlab/gitlabhq!2923
|
|
Don't allow non-members to see private related MRs
See merge request gitlab/gitlabhq!2930
|
|
Validate session key when authorizing with GCP to create a cluster
See merge request gitlab/gitlabhq!2934
|
|
Fix git clone revealing private repo's presence
See merge request gitlab/gitlabhq!2938
|
|
Check snippet attached file to be moved is within designated directory
See merge request gitlab/gitlabhq!2941
|
|
Check validity before querying so that if the dns entry for the api_url
has been changed to something invalid after the model was saved and
checked for validity, it will not query. This is to solve a toctou
(time of check to time of use) issue.
|
|
Fix leaking private repository information in API
See merge request gitlab/gitlabhq!2948
|
|
|
|
Remove link after issue move when no permissions
See merge request gitlab/gitlabhq!2955
|
|
Block local URLs for Kubernetes integration
See merge request gitlab/gitlabhq!2959
|
|
'security-add-public-internal-groups-as-members-to-your-project-idor-11-8' into '11-8-stable'
Add public/internal groups as members to your Project(IDOR)
See merge request gitlab/gitlabhq!2962
|
|
Stop linking to unrecognized package sources
See merge request gitlab/gitlabhq!2969
|
|
Session ID is used as a parameter for the revoke session endpoint but it
should never be included in the HTML as an attacker could obtain it via
XSS.
|
|
|
|
Prevent unauthorized users having access to milestone titles
through autocomplete endpoint.
|
|
|
|
Don't show new issue link after move
when a user does not have permissions
to display the new issue
|
|
Use existing `public_url` validation to block various local urls. Note
that this validation will allow local urls if the "Allow requests to the
local network from hooks and services" admin setting is enabled.
Block KubeClient from using local addresses
It will also respect `allow_local_requests_from_hooks_and_services` so
if that is enabled KubeClinet will allow local addresses
|
|
Previously one could move any temp/ sub folder around.
Align spec with actual usage, as currently we pass temp file path to
FileMover.
|
|
|
|
default_branch, statistics and config_ci_path are now only exposed if
the user has permissions to the repository.
|
|
It was previously possible to link a GCP account to another
user's GitLab account by having them visit the callback URL,
as there was no check that they were the initiator of the
request.
We now reject the callback unless the state parameter
matches the one added to the initiating user's session.
|
|
Ensure redirection to path with .git suffix regardless whether project
exists or not.
|
|
Backport commit author changes from CE
See merge request gitlab-org/gitlab-ce!25294
(cherry picked from commit 8f209ed5eac176fde0272ced69e36467e37fe79a)
886f00bc Backport commit author changes from CE
|
|
Remove TLD validation from cluster domain
Closes #57650
See merge request gitlab-org/gitlab-ce!25262
(cherry picked from commit d02ca097312245e13ba9e1301964342a4327859a)
3016a2a3 Remove TLD validation from Cluster#domain
|
|
Exclude public group milestones from counts in milestones dashboard
Closes #56332
See merge request gitlab-org/gitlab-ce!25230
(cherry picked from commit bd488bc29afbfdfeca5c22ab2caa926525dd666b)
0f0bf2a2 Exclude public group milestones from counts
|