Merge branch 'master' of gitlab.com:gitlab-org/gitlab-ce into configure-protection

Conflicts:
	CHANGELOG
	db/schema.rb

8 files changed, 88 insertions, 30 deletions

diff --git a/lib/api/repositories.rb b/lib/api/repositories.rb
index 03a556a2c55..b259914a01c 100644
--- a/lib/api/repositories.rb
+++ b/lib/api/repositories.rb
@@ -58,11 +58,13 @@ module API
       #   ref_name (optional) - The name of a repository branch or tag, if not given the default branch is used
       # Example Request:
       #   GET /projects/:id/repository/tree
-      get ":id/repository/tree" do
+      get ':id/repository/tree' do
         ref = params[:ref_name] || user_project.try(:default_branch) || 'master'
         path = params[:path] || nil
 
         commit = user_project.repository.commit(ref)
+        not_found!('Tree') unless commit
+
         tree = user_project.repository.tree(commit.id, path)
 
         present tree.sorted_entries, with: Entities::RepoTreeObject
@@ -100,14 +102,18 @@ module API
       #   sha (required) - The blob's sha
       # Example Request:
       #   GET /projects/:id/repository/raw_blobs/:sha
-      get ":id/repository/raw_blobs/:sha" do
+      get ':id/repository/raw_blobs/:sha' do
         ref = params[:sha]
 
         repo = user_project.repository
 
-        blob = Gitlab::Git::Blob.raw(repo, ref)
+        begin
+          blob = Gitlab::Git::Blob.raw(repo, ref)
+        rescue
+          not_found! 'Blob'
+        end
 
-        not_found! "Blob" unless blob
+        not_found! 'Blob' unless blob
 
         env['api.format'] = :txt
 
@@ -122,13 +128,23 @@ module API
       #   sha (optional) - the commit sha to download defaults to the tip of the default branch
       # Example Request:
       #   GET /projects/:id/repository/archive
-      get ":id/repository/archive", requirements: { format: Gitlab::Regex.archive_formats_regex } do
+      get ':id/repository/archive',
+          requirements: { format: Gitlab::Regex.archive_formats_regex } do
         authorize! :download_code, user_project
-        file_path = ArchiveRepositoryService.new.execute(user_project, params[:sha], params[:format])
+
+        begin
+          file_path = ArchiveRepositoryService.new.execute(
+              user_project,
+              params[:sha],
+              params[:format])
+        rescue
+          not_found!('File')
+        end
 
         if file_path && File.exists?(file_path)
           data = File.open(file_path, 'rb').read
-          header["Content-Disposition"] = "attachment; filename=\"#{File.basename(file_path)}\""
+          basename = File.basename(file_path)
+          header['Content-Disposition'] = "attachment; filename=\"#{basename}\""
           content_type MIME::Types.type_for(file_path).first.content_type
           env['api.format'] = :binary
           present data
@@ -161,7 +177,12 @@ module API
       get ':id/repository/contributors' do
         authorize! :download_code, user_project
 
-        present user_project.repository.contributors, with: Entities::Contributor
+        begin
+          present user_project.repository.contributors,
+                  with: Entities::Contributor
+        rescue
+          not_found!
+        end
       end
     end
   end
diff --git a/lib/extracts_path.rb b/lib/extracts_path.rb
index e51cb30bdd9..19215cfb7e6 100644
--- a/lib/extracts_path.rb
+++ b/lib/extracts_path.rb
@@ -1,17 +1,9 @@
 # Module providing methods for dealing with separating a tree-ish string and a
 # file path string when combined in a request parameter
 module ExtractsPath
-  extend ActiveSupport::Concern
-
   # Raised when given an invalid file path
   class InvalidPathError < StandardError; end
 
-  included do
-    if respond_to?(:before_filter)
-      before_filter :assign_ref_vars
-    end
-  end
-
   # Given a string containing both a Git tree-ish, such as a branch or tag, and
   # a filesystem path joined by forward slashes, attempts to separate the two.
   #
diff --git a/lib/gitlab/backend/grack_auth.rb b/lib/gitlab/backend/grack_auth.rb
index 1f71906bc8e..2e393f753e8 100644
--- a/lib/gitlab/backend/grack_auth.rb
+++ b/lib/gitlab/backend/grack_auth.rb
@@ -34,7 +34,7 @@ module Grack
     def auth!
       if @auth.provided?
         return bad_request unless @auth.basic?
-
+        
         # Authentication with username and password
         login, password = @auth.credentials
 
@@ -71,8 +71,20 @@ module Grack
       false
     end
 
+    def oauth_access_token_check(login, password)
+      if login == "oauth2" && git_cmd == 'git-upload-pack' && password.present?
+        token = Doorkeeper::AccessToken.by_token(password)
+        token && token.accessible? && User.find_by(id: token.resource_owner_id)
+      end
+    end
+
     def authenticate_user(login, password)
       user = Gitlab::Auth.new.find(login, password)
+      
+      unless user
+        user = oauth_access_token_check(login, password)
+      end
+      
       return user if user.present?
 
       # At this point, we know the credentials were wrong. We let Rack::Attack
diff --git a/lib/gitlab/commits_calendar.rb b/lib/gitlab/commits_calendar.rb
new file mode 100644
index 00000000000..ccc80d080af
--- /dev/null
+++ b/lib/gitlab/commits_calendar.rb
@@ -0,0 +1,25 @@
+module Gitlab
+  class CommitsCalendar
+    attr_reader :timestamps
+
+    def initialize(repositories, user)
+      @timestamps = {}
+      date_timestamps = []
+
+      repositories.select(&:exists?).reject(&:empty?).each do |raw_repository|
+        commits_log = raw_repository.commits_per_day_for_user(user)
+        date_timestamps << commits_log
+      end
+
+      date_timestamps = date_timestamps.inject do |collection, date|
+        collection.merge(date) { |k, old_v, new_v| old_v + new_v }
+      end
+
+      date_timestamps ||= []
+      date_timestamps.each do |date, commits|
+        timestamp = Date.parse(date).to_time.to_i.to_s rescue nil
+        @timestamps[timestamp] = commits if timestamp
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/git_access.rb b/lib/gitlab/git_access.rb
index c7bf2efc628..ea96d04c5ab 100644
--- a/lib/gitlab/git_access.rb
+++ b/lib/gitlab/git_access.rb
@@ -73,7 +73,7 @@ module Gitlab
       changes = changes.lines if changes.kind_of?(String)
 
       # Iterate over all changes to find if user allowed all of them to be applied
-      changes.each do |change|
+      changes.map(&:strip).reject(&:blank?).each do |change|
         status = change_access_check(user, project, change)
         unless status.allowed?
           # If user does not have access to make at least one change - cancel all push
diff --git a/lib/gitlab/ldap/user.rb b/lib/gitlab/ldap/user.rb
index 3ef494ba137..cfa8692659d 100644
--- a/lib/gitlab/ldap/user.rb
+++ b/lib/gitlab/ldap/user.rb
@@ -40,12 +40,16 @@ module Gitlab
 
       def update_user_attributes
         gl_user.email = auth_hash.email
-        gl_user.identities.build(provider: auth_hash.provider, extern_uid: auth_hash.uid)
+
+        # Build new identity only if we dont have have same one
+        gl_user.identities.find_or_initialize_by(provider: auth_hash.provider,
+                                                 extern_uid: auth_hash.uid)
+
         gl_user
       end
 
       def changed?
-        gl_user.changed?
+        gl_user.changed? || gl_user.identities.any?(&:changed?)
       end
 
       def needs_blocking?
diff --git a/lib/gitlab/markdown.rb b/lib/gitlab/markdown.rb
index 068c342398b..c0e83fb3078 100644
--- a/lib/gitlab/markdown.rb
+++ b/lib/gitlab/markdown.rb
@@ -208,7 +208,7 @@ module Gitlab
     end
 
     def reference_issue(identifier, project = @project, prefix_text = nil)
-      if project.used_default_issues_tracker? || !external_issues_tracker_enabled?
+      if project.default_issues_tracker?
         if project.issue_exists? identifier
           url = url_for_issue(identifier, project)
           title = title_for_issue(identifier, project)
@@ -220,10 +220,8 @@ module Gitlab
           link_to("#{prefix_text}##{identifier}", url, options)
         end
       else
-        config = Gitlab.config
-        external_issue_tracker = config.issues_tracker[project.issues_tracker]
-        if external_issue_tracker.present?
-          reference_external_issue(identifier, external_issue_tracker, project,
+        if project.external_issue_tracker.present?
+          reference_external_issue(identifier, project,
                                    prefix_text)
         end
       end
@@ -267,10 +265,10 @@ module Gitlab
       end
     end
 
-    def reference_external_issue(identifier, issue_tracker, project = @project,
+    def reference_external_issue(identifier, project = @project,
                                  prefix_text = nil)
       url = url_for_issue(identifier, project)
-      title = issue_tracker['title']
+      title = project.external_issue_tracker.title
 
       options = html_options.merge(
         title: "Issue in #{title}",
diff --git a/lib/gitlab/satellite/files/new_file_action.rb b/lib/gitlab/satellite/files/new_file_action.rb
index 15e9b7a6f77..5b657c7aba2 100644
--- a/lib/gitlab/satellite/files/new_file_action.rb
+++ b/lib/gitlab/satellite/files/new_file_action.rb
@@ -14,7 +14,14 @@ module Gitlab
           prepare_satellite!(repo)
 
           # create target branch in satellite at the corresponding commit from bare repo
-          repo.git.checkout({raise: true, timeout: true, b: true}, ref, "origin/#{ref}")
+          current_ref =
+            if @project.empty_repo?
+              # skip this step if we want to add first file to empty repo
+              Satellite::PARKING_BRANCH
+            else
+              repo.git.checkout({raise: true, timeout: true, b: true}, ref, "origin/#{ref}")
+              ref
+            end
 
           file_path_in_satellite = File.join(repo.working_dir, file_path)
           dir_name_in_satellite = File.dirname(file_path_in_satellite)
@@ -38,10 +45,9 @@ module Gitlab
           # will raise CommandFailed when commit fails
           repo.git.commit(raise: true, timeout: true, a: true, m: commit_message)
 
-
           # push commit back to bare repo
           # will raise CommandFailed when push fails
-          repo.git.push({raise: true, timeout: true}, :origin, ref)
+          repo.git.push({raise: true, timeout: true}, :origin, "#{current_ref}:#{ref}")
 
           # everything worked
           true