| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
| |
Fix permissions check in `RelativeLinkFilter`
See merge request gitlab-org/gitlab-ce!32448
|
| |\
| |
| |
| |
| |
| |
| | |
'12-2-stable-patch-4'
Add StubConfiguration.stub_config method
See merge request gitlab-org/gitlab-ce!32530
|
| |/ |
|
| |
|
|
|
| |
Update Mermaid to v8.2.6
See merge request gitlab-org/gitlab-ce!32502
|
| |
|
|
|
|
|
|
|
|
|
| |
Revert "Merge branch 'nik-api-snippets-fix' into 'master'"
Closes #66673
See merge request gitlab-org/gitlab-ce!32295
(cherry picked from commit 98f2ab296a9b53b7e6fe467b50a9bcf9b75c6957)
5e0378b3 Revert "Merge branch 'nik-api-snippets-fix' into 'master'"
|
| |
|
|
|
|
|
|
|
|
|
| |
Fix snippets API not working with visibility level
Closes #66050
See merge request gitlab-org/gitlab-ce!32286
(cherry picked from commit 1843502ff4d9841f9abf635ffb57d72068ec90c9)
680f4377 Fix snippets API not working with visibility level
|
| |
|
|
|
|
|
|
|
|
|
| |
Fix Piwik not working
Closes #66627
See merge request gitlab-org/gitlab-ce!32234
(cherry picked from commit 0c639b2463a4d70bb275e4f139a88594e674a240)
f6058981 Fix Piwik not working
|
| |
|
|
|
|
|
|
|
| |
Upgrade Mermaid to v8.2.4
See merge request gitlab-org/gitlab-ce!32186
(cherry picked from commit f90759bbf31853e0e69db98588f2416cdef6e2f6)
c2541b64 Upgrade Mermaid to v8.2.4
|
| |
|
|
|
|
|
|
|
|
|
| |
Add helpers to exactly undo cleanup_concurrent_column_rename
See merge request gitlab-org/gitlab-ce!32183
(cherry picked from commit fc08d48cf0a596dc151cb7bc7ab0f7d2721f3333)
9b592a59 Add helper to exactly undo cleanup_concurrent_column_rename
61777843 Add spec for undo_rename_column_concurrently
d28ad870 Add spec for when default is false
|
| |
|
|
|
|
|
|
|
| |
fix: remove double %
See merge request gitlab-org/gitlab-ce!32178
(cherry picked from commit bf2b4c526955829e8eb99fe8557563b2cb8f775f)
22e2a601 fix: remove double % from layout width description
|
| |
|
|
|
|
|
|
|
| |
Fix N+1 Gitaly calls in /api/v4/projects/:id/issues
See merge request gitlab-org/gitlab-ce!32171
(cherry picked from commit bbd39021c39b66ecb954a7fb8276320556b65a3b)
44063501 Fix N+1 Gitaly calls in /api/v4/projects/:id/issues
|
| |
|
|
|
|
|
|
|
|
|
| |
'master'
Fix issuable sidebar icon of notification disabled
See merge request gitlab-org/gitlab-ce!32134
(cherry picked from commit a93612aa5fab7d70f0b6165856402ac53ab18faf)
9ad0a8ad Fix issuable sidebar icon of notification disabled
|
| |
|
|
|
|
|
|
|
|
|
| |
Match syntax highlighting theme for line expansion rows
Closes #66066
See merge request gitlab-org/gitlab-ce!31821
(cherry picked from commit 1349a3d5b3b6d6bc151429a969b4cc78fd91c355)
9013ab1f Add syntax highlighting for line expansion
|
| | |
|
| |
|
| |
[ci skip]
|
| |
|
|
|
|
|
|
|
| |
'66641-broken-master-real-http-connections-are-disabled-unregistered-request' into 'master'
Use `stub_full_request` to fix spec failure
Closes #66641
See merge request gitlab-org/gitlab-ce!32259
|
| |
|
|
| |
This reverts commit cec9310c4ad641a760daa0394b6a8945d134dbb8.
|
| |\
| |
| |
| |
| |
| |
| | |
'security-fix-something-went-wrong-on-when-not-logged-in-ce-12-2' into '12-2-stable'
Return NO_ACCESS if user is nil
See merge request gitlab/gitlabhq!3390
|
| |/ |
|
| | |
|
| |
|
| |
[ci skip]
|
| |\
| |
| |
| |
| | |
Avoid exposing unaccessible repo data upon GFM post processing
See merge request gitlab/gitlabhq!3382
|
| |/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When post-processing relative links to absolute links
RelativeLinkFilter didn't take into consideration that
internal repository data could be exposed for users
that do not have repository access to the project.
This commit solves that by checking whether the user
can `download_code` at this repository, avoiding any
processing of this filter if the user can't.
Additionally, if we're processing for a group (
no project was given), we check if the user can
read it in order to expand the href as an extra.
That doesn't seem necessarily a breach now,
but an extra check doesn't hurt as after all
the user needs to be able to `read_group`.
|
| |\
| |
| |
| |
| |
| |
| | |
'12-2-stable'
Ensure only authorised users can create notes on merge requests and issues
See merge request gitlab/gitlabhq!3324
|
| |/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Prevent creating notes on inaccessible MRs
This applies the notes rules at the MR scope. Rather than adding extra
rules to the Project level policy, preventing :create_note here is
better since it only prevents creating notes on MRs.
* Prevent creating notes in inaccessible Issues
without this policy, non-team-members are allowed to comment on issues
even when the project has the private-issues policy set. This means that
without this change, users are allowed to comment on issues that they
cannot read.
* Add CHANGELOG entry
|
| |\
| |
| |
| |
| | |
Prevent disclosure of merge request id via email
See merge request gitlab/gitlabhq!3350
|
| | |
| |
| |
| |
| | |
Do not disclosure merge request id via email for unauthorized users
when closing issues.
|
| |\ \
| | |
| | |
| | |
| | | |
Send TODOs for comments on commits correctly
See merge request gitlab/gitlabhq!3365
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
At present, the TodoService uses the `:read_project` ability to decide
whether a user can read a note on a commit. However, commits can have a
visibility level that is more restricted than the project, so this is a
security issue.
This commit changes the code to use the `:read_commit` ability in this
case instead, which ensures TODOs are only generated for commit notes
if the users can see the commit.
|
| |\ \ \
| | | |
| | | |
| | | |
| | | | |
Gitaly: ignore git redirects
See merge request gitlab/gitlabhq!3374
|
| | | | | |
|
| |\ \ \ \
| |/ / /
|/| | |
| | | |
| | | | |
Project visibility restriction bypass
See merge request gitlab/gitlabhq!3330
|
| |/ / /
| | |
| | |
| | |
| | |
| | | |
Add Gitlab::VisibilityLevelChecker that verifies
selected project visibility level (or overridden param)
is not restricted when creating or importing a project
|
| |\ \ \
| | | |
| | | |
| | | |
| | | | |
DNS Rebind SSRF in Kubernetes Integration
See merge request gitlab/gitlabhq!3268
|
| | | | | |
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Kubeclient uses rest-client. We hack into to access the net/http object
so that we can patch to connect to the resolved IP + set
hostname_override.
Add specs for discord. The discord integration also uses rest-client, so
since we patched rest-client, spec that the DNS rebinding protection
works
|
| |\ \ \ \
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
'12-2-stable'
Filter out old system notes for epics in notes api endpoint response
See merge request gitlab/gitlabhq!3314
|
| | | | | | |
|
| |\ \ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
into '12-2-stable'
Fix HTML injection for label description
See merge request gitlab/gitlabhq!3315
|
| | |/ / / / |
|
| |\ \ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Permission fix for MergeRequestsController#pipeline_status
See merge request gitlab/gitlabhq!3322
|
| | |/ / / /
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
- Use set_pipeline_variables to filter for visible pipelines
- Mimic response of nonexistent pipeline if not found
- Provide set_pipeline_variables as a before_filter for other actions
|
| |\ \ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Limit the size of issuable description and comments
See merge request gitlab/gitlabhq!3323
|
| | | |_|_|/
| |/| | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Limiting the size of issuable description and comments to 1_000_000,
which is close to ~1MB of ASCII characters, which represents 99.9% of
all descriptions and comments we have in DB at the moment. This should
help prevent DoS attacks when comments contain refference strings.
Also this change updates regexp matching the namespaces paths by
limiting the namespaces paths to Namespace::NUMBER_OF_ANCESTORS_ALLOWED,
as we allow 20 levels deep groups.
see https://gitlab.com/gitlab-org/gitlab-ce/issues/61974#note_191274234
|
| |\ \ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
'12-2-stable'
Add merge note type as cross reference
See merge request gitlab/gitlabhq!3328
|
| | |/ / / / |
|
| |\ \ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Use image proxy to mitigate stealing ip addresses
See merge request gitlab/gitlabhq!3333
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | | |
for ApplicationSettings
|
| | | |/ / /
| |/| | |
| | | | |
| | | | |
| | | | |
| | | | | |
User images and videos will get proxied through
the Camo server in order to keep malicious
sites from collecting the IP address of users.
|
| |\ \ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Fix DNS rebind vulnerability for JIRA integration
See merge request gitlab/gitlabhq!3338
|
