diff options
Diffstat (limited to 'config')
| -rw-r--r-- | config/application.rb | 10 | ||||
| -rw-r--r-- | config/dependency_decisions.yml | 31 | ||||
| -rw-r--r-- | config/gitlab.yml.example | 4 | ||||
| -rw-r--r-- | config/initializers/1_settings.rb | 21 | ||||
| -rw-r--r-- | config/initializers/6_validations.rb | 21 | ||||
| -rw-r--r-- | config/initializers/metrics.rb | 8 | ||||
| -rw-r--r-- | config/initializers/mime_types.rb | 8 | ||||
| -rw-r--r-- | config/initializers/relative_naming_ci_namespace.rb | 16 | ||||
| -rw-r--r-- | config/initializers/request_profiler.rb | 5 | ||||
| -rw-r--r-- | config/initializers/secure_headers.rb | 109 | ||||
| -rw-r--r-- | config/initializers/sidekiq.rb | 11 | ||||
| -rw-r--r-- | config/initializers/trusted_proxies.rb | 12 | ||||
| -rw-r--r-- | config/routes.rb | 55 |
13 files changed, 144 insertions, 167 deletions
diff --git a/config/application.rb b/config/application.rb index 5f7b6a3c049..06ebb14a5fe 100644 --- a/config/application.rb +++ b/config/application.rb @@ -76,15 +76,15 @@ module Gitlab # Enable the asset pipeline config.assets.enabled = true - config.assets.paths << Gemojione.index.images_path + config.assets.paths << Gemojione.images_path config.assets.precompile << "*.png" config.assets.precompile << "print.css" config.assets.precompile << "notify.css" config.assets.precompile << "mailers/*.css" - config.assets.precompile << "graphs/application.js" - config.assets.precompile << "users/application.js" - config.assets.precompile << "network/application.js" - config.assets.precompile << "profile/application.js" + config.assets.precompile << "graphs/graphs_bundle.js" + config.assets.precompile << "users/users_bundle.js" + config.assets.precompile << "network/network_bundle.js" + config.assets.precompile << "profile/profile_bundle.js" config.assets.precompile << "lib/utils/*.js" config.assets.precompile << "lib/*.js" config.assets.precompile << "u2f.js" diff --git a/config/dependency_decisions.yml b/config/dependency_decisions.yml index 293f2b71d65..74325872b09 100644 --- a/config/dependency_decisions.yml +++ b/config/dependency_decisions.yml @@ -68,6 +68,25 @@ :why: https://opensource.org/licenses/BSD-2-Clause :versions: [] :when: 2016-05-02 05:55:09.796363000 Z +- - :whitelist + - LGPLv2+ + - :who: Stan Hu + :why: Equivalent to LGPLv2 + :versions: [] + :when: 2016-06-07 17:14:10.907682000 Z +- - :whitelist + - Artistic 2.0 + - :who: Josh Frye + :why: Disk/mount information display on Admin pages + :versions: [] + :when: 2016-06-29 16:32:45.432113000 Z +- - :whitelist + - Simplified BSD + - :who: Douwe Maan + :why: https://opensource.org/licenses/BSD-2-Clause + :versions: [] + :when: 2016-07-26 21:24:07.248480000 Z + # LICENSE BLACKLIST - - :blacklist @@ -175,15 +194,3 @@ :why: https://github.com/jmcnevin/rubypants/blob/master/LICENSE.rdoc :versions: [] :when: 2016-05-02 05:56:50.696858000 Z -- - :whitelist - - LGPLv2+ - - :who: Stan Hu - :why: Equivalent to LGPLv2 - :versions: [] - :when: 2016-06-07 17:14:10.907682000 Z -- - :whitelist - - Artistic 2.0 - - :who: Josh Frye - :why: Disk/mount information display on Admin pages - :versions: [] - :when: 2016-06-29 16:32:45.432113000 Z diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example index 325eca72862..1470a6e2550 100644 --- a/config/gitlab.yml.example +++ b/config/gitlab.yml.example @@ -106,8 +106,8 @@ production: &base ## Repository downloads directory # When a user clicks e.g. 'Download zip' on a project, a temporary zip file is created in the following directory. - # The default is 'tmp/repositories' relative to the root of the Rails app. - # repository_downloads_path: tmp/repositories + # The default is 'shared/cache/archive/' relative to the root of the Rails app. + # repository_downloads_path: shared/cache/archive/ ## Reply by email # Allow users to comment on issues and merge requests by replying to notification emails. diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb index 51d93e8cde0..49130f37b31 100644 --- a/config/initializers/1_settings.rb +++ b/config/initializers/1_settings.rb @@ -211,8 +211,7 @@ Settings.gitlab.default_projects_features['snippets'] = false if Setti Settings.gitlab.default_projects_features['builds'] = true if Settings.gitlab.default_projects_features['builds'].nil? Settings.gitlab.default_projects_features['container_registry'] = true if Settings.gitlab.default_projects_features['container_registry'].nil? Settings.gitlab.default_projects_features['visibility_level'] = Settings.send(:verify_constant, Gitlab::VisibilityLevel, Settings.gitlab.default_projects_features['visibility_level'], Gitlab::VisibilityLevel::PRIVATE) -Settings.gitlab['repository_downloads_path'] = File.join(Settings.shared['path'], 'cache/archive') if Settings.gitlab['repository_downloads_path'].nil? -Settings.gitlab['restricted_signup_domains'] ||= [] +Settings.gitlab['domain_whitelist'] ||= [] Settings.gitlab['import_sources'] ||= %w[github bitbucket gitlab gitorious google_code fogbugz git gitlab_project] Settings.gitlab['trusted_proxies'] ||= [] @@ -291,6 +290,9 @@ Settings.cron_jobs['repository_archive_cache_worker']['job_class'] = 'Repository Settings.cron_jobs['gitlab_remove_project_export_worker'] ||= Settingslogic.new({}) Settings.cron_jobs['gitlab_remove_project_export_worker']['cron'] ||= '0 * * * *' Settings.cron_jobs['gitlab_remove_project_export_worker']['job_class'] = 'GitlabRemoveProjectExportWorker' +Settings.cron_jobs['requests_profiles_worker'] ||= Settingslogic.new({}) +Settings.cron_jobs['requests_profiles_worker']['cron'] ||= '0 0 * * *' +Settings.cron_jobs['requests_profiles_worker']['job_class'] = 'RequestsProfilesWorker' # # GitLab Shell @@ -316,6 +318,21 @@ Settings.repositories['storages'] ||= {} Settings.repositories.storages['default'] ||= Settings.gitlab_shell['repos_path'] || Settings.gitlab['user_home'] + '/repositories/' # +# The repository_downloads_path is used to remove outdated repository +# archives, if someone has it configured incorrectly, and it points +# to the path where repositories are stored this can cause some +# data-integrity issue. In this case, we sets it to the default +# repository_downloads_path value. +# +repositories_storages_path = Settings.repositories.storages.values +repository_downloads_path = Settings.gitlab['repository_downloads_path'].to_s.gsub(/\/$/, '') +repository_downloads_full_path = File.expand_path(repository_downloads_path, Settings.gitlab['user_home']) + +if repository_downloads_path.blank? || repositories_storages_path.any? { |path| [repository_downloads_path, repository_downloads_full_path].include?(path.gsub(/\/$/, '')) } + Settings.gitlab['repository_downloads_path'] = File.join(Settings.shared['path'], 'cache/archive') +end + +# # Backup # Settings['backup'] ||= Settingslogic.new({}) diff --git a/config/initializers/6_validations.rb b/config/initializers/6_validations.rb index 3ba9e36c567..d92f64e1647 100644 --- a/config/initializers/6_validations.rb +++ b/config/initializers/6_validations.rb @@ -3,22 +3,27 @@ def storage_name_valid?(name) end def find_parent_path(name, path) + parent = Pathname.new(path).realpath.parent Gitlab.config.repositories.storages.detect do |n, p| - name != n && path.chomp('/').start_with?(p.chomp('/')) + name != n && Pathname.new(p).realpath == parent end end -def error(message) +def storage_validation_error(message) raise "#{message}. Please fix this in your gitlab.yml before starting GitLab." end -error('No repository storage path defined') if Gitlab.config.repositories.storages.empty? +def validate_storages + storage_validation_error('No repository storage path defined') if Gitlab.config.repositories.storages.empty? -Gitlab.config.repositories.storages.each do |name, path| - error("\"#{name}\" is not a valid storage name") unless storage_name_valid?(name) + Gitlab.config.repositories.storages.each do |name, path| + storage_validation_error("\"#{name}\" is not a valid storage name") unless storage_name_valid?(name) - parent_name, _parent_path = find_parent_path(name, path) - if parent_name - error("#{name} is a nested path of #{parent_name}. Nested paths are not supported for repository storages") + parent_name, _parent_path = find_parent_path(name, path) + if parent_name + storage_validation_error("#{name} is a nested path of #{parent_name}. Nested paths are not supported for repository storages") + end end end + +validate_storages unless Rails.env.test? || ENV['SKIP_STORAGE_VALIDATION'] == 'true' diff --git a/config/initializers/metrics.rb b/config/initializers/metrics.rb index c4266ab8ba5..b68a09ce730 100644 --- a/config/initializers/metrics.rb +++ b/config/initializers/metrics.rb @@ -136,7 +136,15 @@ if Gitlab::Metrics.enabled? config.instrument_instance_methods(Rouge::Plugins::Redcarpet) config.instrument_instance_methods(Rouge::Formatters::HTMLGitlab) + [:XML, :HTML].each do |namespace| + namespace_mod = Nokogiri.const_get(namespace) + + config.instrument_methods(namespace_mod) + config.instrument_methods(namespace_mod::Document) + end + config.instrument_methods(Rinku) + config.instrument_instance_methods(Repository) end GC::Profiler.enable diff --git a/config/initializers/mime_types.rb b/config/initializers/mime_types.rb index ca58ae92d1b..3e553120205 100644 --- a/config/initializers/mime_types.rb +++ b/config/initializers/mime_types.rb @@ -6,5 +6,9 @@ Mime::Type.register_alias "text/plain", :diff Mime::Type.register_alias "text/plain", :patch -Mime::Type.register_alias 'text/html', :markdown -Mime::Type.register_alias 'text/html', :md +Mime::Type.register_alias "text/html", :markdown +Mime::Type.register_alias "text/html", :md + +Mime::Type.register "video/mp4", :mp4, [], [:m4v, :mov] +Mime::Type.register "video/webm", :webm +Mime::Type.register "video/ogg", :ogv diff --git a/config/initializers/relative_naming_ci_namespace.rb b/config/initializers/relative_naming_ci_namespace.rb new file mode 100644 index 00000000000..59abe1b9b91 --- /dev/null +++ b/config/initializers/relative_naming_ci_namespace.rb @@ -0,0 +1,16 @@ +# Description: https://coderwall.com/p/heed_q/rails-routing-and-namespaced-models +# +# This allows us to use CI ActiveRecord objects in all routes and use it: +# - [project.namespace, project, build] +# +# instead of: +# - namespace_project_build_path(project.namespace, project, build) +# +# Without that, Ci:: namespace is used for resolving routes: +# - namespace_project_ci_build_path(project.namespace, project, build) + +module Ci + def self.use_relative_model_naming? + true + end +end diff --git a/config/initializers/request_profiler.rb b/config/initializers/request_profiler.rb new file mode 100644 index 00000000000..a9aa802681a --- /dev/null +++ b/config/initializers/request_profiler.rb @@ -0,0 +1,5 @@ +require 'gitlab/request_profiler/middleware' + +Rails.application.configure do |config| + config.middleware.use(Gitlab::RequestProfiler::Middleware) +end diff --git a/config/initializers/secure_headers.rb b/config/initializers/secure_headers.rb deleted file mode 100644 index 9fd24a667cc..00000000000 --- a/config/initializers/secure_headers.rb +++ /dev/null @@ -1,109 +0,0 @@ -# CSP headers have to have single quotes, so failures relating to quotes -# inside Ruby string arrays are irrelevant. -# rubocop:disable Lint/PercentStringArray -require 'gitlab/current_settings' -include Gitlab::CurrentSettings - -# If Sentry is enabled and the Rails app is running in production mode, -# this will construct the Report URI for Sentry. -if Rails.env.production? && current_application_settings.sentry_enabled - uri = URI.parse(current_application_settings.sentry_dsn) - CSP_REPORT_URI = "#{uri.scheme}://#{uri.host}/api#{uri.path}/csp-report/?sentry_key=#{uri.user}" -else - CSP_REPORT_URI = '' -end - -# Content Security Policy Headers -# For more information on CSP see: -# - https://gitlab.com/gitlab-org/gitlab-ce/issues/18231 -# - https://developer.mozilla.org/en-US/docs/Web/Security/CSP/CSP_policy_directives -SecureHeaders::Configuration.default do |config| - # Mark all cookies as "Secure", "HttpOnly", and "SameSite=Strict". - config.cookies = { - secure: true, - httponly: true, - samesite: { - strict: true - } - } - config.x_content_type_options = "nosniff" - config.x_xss_protection = "1; mode=block" - config.x_download_options = "noopen" - config.x_permitted_cross_domain_policies = "none" - config.referrer_policy = "origin-when-cross-origin" - config.csp = { - # "Meta" values. - report_only: true, - preserve_schemes: true, - - # "Directive" values. - # Default source allows nothing, more permissive values are set per-policy. - default_src: %w('none'), - # (Deprecated) Don't allow iframes. - frame_src: %w('none'), - # Only allow XMLHTTPRequests from the GitLab instance itself. - connect_src: %w('self'), - # Only load local fonts. - font_src: %w('self'), - # Load local images, any external image available over HTTPS. - img_src: %w(* 'self' data:), - # Audio and video can't be played on GitLab currently, so it's disabled. - media_src: %w('none'), - # Don't allow <object>, <embed>, or <applet> elements. - object_src: %w('none'), - # Allow local scripts and inline scripts. - script_src: %w('unsafe-inline' 'unsafe-eval' 'self'), - # Allow local stylesheets and inline styles. - style_src: %w('unsafe-inline' 'self'), - # The URIs that a user agent may use as the document base URL. - base_uri: %w('self'), - # Only allow local iframes and service workers - child_src: %w('self'), - # Only submit form information to the GitLab instance. - form_action: %w('self'), - # Disallow any parents from embedding a page in an iframe. - frame_ancestors: %w('none'), - # Don't allow any plugins (Flash, Shockwave, etc.) - plugin_types: %w(), - # Blocks all mixed (HTTP) content. - block_all_mixed_content: true, - # Upgrades insecure requests to HTTPS when possible. - upgrade_insecure_requests: true - } - - # Reports are sent to Sentry if it's enabled. - if current_application_settings.sentry_enabled - config.csp[:report_uri] = %W(#{CSP_REPORT_URI}) - end - - # Allow Bootstrap Linter in development mode. - if Rails.env.development? - config.csp[:script_src] << "maxcdn.bootstrapcdn.com" - end - - # reCAPTCHA - if current_application_settings.recaptcha_enabled - config.csp[:script_src] << "https://www.google.com/recaptcha/" - config.csp[:script_src] << "https://www.gstatic.com/recaptcha/" - config.csp[:frame_src] << "https://www.google.com/recaptcha/" - config.x_frame_options = "SAMEORIGIN" - end - - # Gravatar - if current_application_settings.gravatar_enabled? - config.csp[:img_src] << "www.gravatar.com" - config.csp[:img_src] << "secure.gravatar.com" - config.csp[:img_src] << Gitlab.config.gravatar.host - end - - # Piwik - if Gitlab.config.extra.has_key?('piwik_url') && Gitlab.config.extra.has_key?('piwik_site_id') - config.csp[:script_src] << Gitlab.config.extra.piwik_url - config.csp[:img_src] << Gitlab.config.extra.piwik_url - end - - # Google Analytics - if Gitlab.config.extra.has_key?('google_analytics_id') - config.csp[:script_src] << "https://www.google-analytics.com" - end -end diff --git a/config/initializers/sidekiq.rb b/config/initializers/sidekiq.rb index 593c14a289f..cf49ec2194c 100644 --- a/config/initializers/sidekiq.rb +++ b/config/initializers/sidekiq.rb @@ -7,13 +7,22 @@ Sidekiq.configure_server do |config| config.server_middleware do |chain| chain.add Gitlab::SidekiqMiddleware::ArgumentsLogger if ENV['SIDEKIQ_LOG_ARGUMENTS'] chain.add Gitlab::SidekiqMiddleware::MemoryKiller if ENV['SIDEKIQ_MEMORY_KILLER_MAX_RSS'] + chain.add Gitlab::SidekiqMiddleware::RequestStoreMiddleware unless ENV['SIDEKIQ_REQUEST_STORE'] == '0' end # Sidekiq-cron: load recurring jobs from gitlab.yml # UGLY Hack to get nested hash from settingslogic cron_jobs = JSON.parse(Gitlab.config.cron_jobs.to_json) # UGLY hack: Settingslogic doesn't allow 'class' key - cron_jobs.each { |k, v| cron_jobs[k]['class'] = cron_jobs[k].delete('job_class') } + cron_jobs_required_keys = %w(job_class cron) + cron_jobs.each do |k, v| + if cron_jobs[k] && cron_jobs_required_keys.all? { |s| cron_jobs[k].key?(s) } + cron_jobs[k]['class'] = cron_jobs[k].delete('job_class') + else + cron_jobs.delete(k) + Rails.logger.error("Invalid cron_jobs config key: '#{k}'. Check your gitlab config file.") + end + end Sidekiq::Cron::Job.load_from_hash! cron_jobs # Database pool should be at least `sidekiq_concurrency` + 2 diff --git a/config/initializers/trusted_proxies.rb b/config/initializers/trusted_proxies.rb index df4a933e22f..cd869657c53 100644 --- a/config/initializers/trusted_proxies.rb +++ b/config/initializers/trusted_proxies.rb @@ -7,10 +7,18 @@ module Rack class Request def trusted_proxy?(ip) Rails.application.config.action_dispatch.trusted_proxies.any? { |proxy| proxy === ip } + rescue IPAddr::InvalidAddressError + false end end end +gitlab_trusted_proxies = Array(Gitlab.config.gitlab.trusted_proxies).map do |proxy| + begin + IPAddr.new(proxy) + rescue IPAddr::InvalidAddressError + end +end.compact + Rails.application.config.action_dispatch.trusted_proxies = ( - [ '127.0.0.1', '::1' ] + Array(Gitlab.config.gitlab.trusted_proxies) -).map { |proxy| IPAddr.new(proxy) } + [ '127.0.0.1', '::1' ] + gitlab_trusted_proxies) diff --git a/config/routes.rb b/config/routes.rb index 3160fd767b8..2f5f32d9e30 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -42,10 +42,9 @@ Rails.application.routes.draw do resource :lint, only: [:show, :create] - resources :projects do + resources :projects, only: [:index, :show] do member do get :status, to: 'projects#badge' - get :integration end end @@ -89,11 +88,10 @@ Rails.application.routes.draw do mount Grack::AuthSpawner, at: '/', constraints: lambda { |request| /[-\/\w\.]+\.git\/(info\/lfs|gitlab-lfs)/.match(request.path_info) }, via: [:get, :post, :put] # Help - - get 'help' => 'help#index' - get 'help/*path' => 'help#show', as: :help_page - get 'help/shortcuts' - get 'help/ui' => 'help#ui' + get 'help' => 'help#index' + get 'help/shortcuts' => 'help#shortcuts' + get 'help/ui' => 'help#ui' + get 'help/*path' => 'help#show', as: :help_page # # Global snippets @@ -145,13 +143,13 @@ Rails.application.routes.draw do get :jobs end - resource :gitlab, only: [:create, :new], controller: :gitlab do + resource :gitlab, only: [:create], controller: :gitlab do get :status get :callback get :jobs end - resource :bitbucket, only: [:create, :new], controller: :bitbucket do + resource :bitbucket, only: [:create], controller: :bitbucket do get :status get :callback get :jobs @@ -244,7 +242,6 @@ Rails.application.routes.draw do get :projects get :keys get :groups - put :team_update put :block put :unblock put :unlock @@ -282,6 +279,7 @@ Rails.application.routes.draw do resource :health_check, controller: 'health_check', only: [:show] resource :background_jobs, controller: 'background_jobs', only: [:show] resource :system_info, controller: 'system_info', only: [:show] + resources :requests_profiles, only: [:index, :show], param: :name, constraints: { name: /.+\.html/ } resources :namespaces, path: '/projects', constraints: { id: /[a-zA-Z.0-9_\-]+/ }, only: [] do root to: 'projects#index', as: :projects @@ -301,7 +299,7 @@ Rails.application.routes.draw do end end - resource :appearances, path: 'appearance' do + resource :appearances, only: [:show, :create, :update], path: 'appearance' do member do get :preview delete :logo @@ -310,7 +308,7 @@ Rails.application.routes.draw do end resource :application_settings, only: [:show, :update] do - resources :services + resources :services, only: [:index, :edit, :update] put :reset_runners_token put :reset_health_check_token put :clear_repository_check_states @@ -347,7 +345,7 @@ Rails.application.routes.draw do end scope module: :profiles do - resource :account, only: [:show, :update] do + resource :account, only: [:show] do member do delete :unlink end @@ -359,7 +357,7 @@ Rails.application.routes.draw do end end resource :preferences, only: [:show, :update] - resources :keys + resources :keys, only: [:index, :show, :new, :create, :destroy] resources :emails, only: [:index, :create, :destroy] resource :avatar, only: [:destroy] @@ -628,13 +626,17 @@ Rails.application.routes.draw do get '/compare/:from...:to', to: 'compare#show', as: 'compare', constraints: { from: /.+/, to: /.+/ } - resources :network, only: [:show], constraints: { id: /(?:[^.]|\.(?!json$))+/, format: /json/ } + # Don't use format parameter as file extension (old 3.0.x behavior) + # See http://guides.rubyonrails.org/routing.html#route-globbing-and-wildcard-segments + scope format: false do + resources :network, only: [:show], constraints: { id: Gitlab::Regex.git_reference_regex } - resources :graphs, only: [:show], constraints: { id: /(?:[^.]|\.(?!json$))+/, format: /json/ } do - member do - get :commits - get :ci - get :languages + resources :graphs, only: [:show], constraints: { id: Gitlab::Regex.git_reference_regex } do + member do + get :commits + get :ci + get :languages + end end end @@ -661,7 +663,7 @@ Rails.application.routes.draw do post '/wikis/*id/markdown_preview', to: 'wikis#markdown_preview', constraints: WIKI_SLUG_ID, as: 'wiki_markdown_preview' end - resource :repository, only: [:show, :create] do + resource :repository, only: [:create] do member do get 'archive', constraints: { format: Gitlab::Regex.archive_formats_regex } end @@ -733,13 +735,17 @@ Rails.application.routes.draw do resources :triggers, only: [:index, :create, :destroy] resources :pipelines, only: [:index, :new, :create, :show] do + collection do + resource :pipelines_settings, path: 'settings', only: [:show, :update] + end + member do post :cancel post :retry end end - resources :environments, only: [:index, :show, :new, :create, :destroy] + resources :environments resources :builds, only: [:index, :show], constraints: { id: /\d+/ } do collection do @@ -750,6 +756,7 @@ Rails.application.routes.draw do get :status post :cancel post :retry + post :play post :erase get :trace get :raw @@ -778,7 +785,7 @@ Rails.application.routes.draw do end end - resources :labels, constraints: { id: /\d+/ } do + resources :labels, except: [:show], constraints: { id: /\d+/ } do collection do post :generate post :set_priorities @@ -803,7 +810,7 @@ Rails.application.routes.draw do end end - resources :project_members, except: [:new, :edit], constraints: { id: /[a-zA-Z.\/0-9_\-#%+]+/ }, concerns: :access_requestable do + resources :project_members, except: [:show, :new, :edit], constraints: { id: /[a-zA-Z.\/0-9_\-#%+]+/ }, concerns: :access_requestable do collection do delete :leave |