delta/gitlab/gitlab-ce.git - gitlab.com: gitlab-org/gitlab-ce.git

	Commit message (Collapse)	Author	Age	Files	Lines
*	Merge branch 'ce-9445-kerberos-clone-url-is-no-longer-visible' into 'master'cherry-pick-c9e5ce8d	Kushal Pandya	2019-03-06	2	-2/+4
\| \| \| \| \| \| \| \| \|	Backport Kerberos clone URL to CE See merge request gitlab-org/gitlab-ce!25750 (cherry picked from commit c9e5ce8dbd25203484b43c48f0a55a5d7bf396e8) c0a97cf5 Backport Kerberos clone URL to CE
*	Update VERSION to 11.8.1v11.8.1	GitLab Release Tools Bot	2019-02-28	1	-1/+1
\|
*	Update CHANGELOG.md for 11.8.1	GitLab Release Tools Bot	2019-02-28	22	-107/+27
\| \| \|	[ci skip]
*	Merge branch '11-8-security-2774-milestones-detail' into '11-8-stable'	Robert Speicher	2019-02-27	4	-4/+112
\|\ \| \| \| \| \| \| \| \|	Display only information visible to current user on Milestone detail See merge request gitlab/gitlabhq!2917
\| *	Display only informaton visible to current user	Jarka Košanová	2019-02-27	4	-4/+112
\|/ \| \| \| \| \|	Display only labels and assignees of issues visible by the currently logged user Display only issues visible to user in the burndown chart
*	Merge branch 'security-id-fix-mr-visibility-11-8' into '11-8-stable'	Yorick Peterse	2019-02-27	7	-213/+335
\|\ \| \| \| \| \| \| \| \|	Display the correct number of MRs a user has access to See merge request gitlab/gitlabhq!2929
\| *	Display the correct number of MRs a user has access to	Igor Drozdov	2019-02-27	7	-213/+335
\|/
*	Merge branch 'security-2818_filter_impersonated_sessions-11-8' into ↵	Yorick Peterse	2019-02-27	8	-52/+38
\|\ \| \| \| \| \| \| \| \| \| \| \| \|	'11-8-stable' Filter impersonated sessions from active sessions and remove ability to revoke session See merge request gitlab/gitlabhq!2981
\| *	Remove ability to revoke active session	Imre Farkas	2019-02-27	6	-49/+7
\| \| \| \| \| \| \| \| \| \| \| \|	Session ID is used as a parameter for the revoke session endpoint but it should never be included in the HTML as an attacker could obtain it via XSS.
\| *	Filter active sessions belonging to an admin impersonating the user	Imre Farkas	2019-02-27	4	-4/+32
\| \|
* \|	Merge branch 'security-id-restricted-access-to-private-repo-11-8' into ↵	Yorick Peterse	2019-02-27	5	-60/+137
\|\ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	'11-8-stable' Forbid creating discussions for users with restricted access See merge request gitlab/gitlabhq!2890
\| * \|	Forbid creating discussions for users with restricted access	Igor Drozdov	2019-02-07	5	-60/+137
\| \| \|
* \| \|	Merge branch '11-8-security-2773-milestones-fix' into '11-8-stable'	Yorick Peterse	2019-02-27	19	-73/+187
\|\ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Check issue milestone availability See merge request gitlab/gitlabhq!2904
\| * \| \|	Check issue milestone availability	Jarka Košanová	2019-02-13	19	-73/+187
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Add project when creating milestone in specs We validate milestone is from the same project/parent group as issuable -> we need to set project in specs correctly Improve methods names and specs organization
* \| \| \|	Merge branch 'security-tags-oracle-11-8' into '11-8-stable'	Yorick Peterse	2019-02-27	3	-0/+23
\|\ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Prevent Releases links API to leak tag existence See merge request gitlab/gitlabhq!2908
\| * \| \| \|	Prevent Releases links API to leak tag existance	Alessio Caiazza	2019-02-13	3	-0/+23
\| \|/ / /
* \| \| \|	Merge branch 'security-2798-fix-boards-policy-11-8' into '11-8-stable'	Yorick Peterse	2019-02-27	3	-8/+19
\|\ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Disable issue board policies when issues are disabled See merge request gitlab/gitlabhq!2910
\| * \| \| \|	Disable board policies when issues are disabled	Heinrich Lee Yu	2019-02-14	3	-8/+19
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Board list policies are also included
* \| \| \| \|	Merge branch '11-8-security-2797-milestone-mrs' into '11-8-stable'	Yorick Peterse	2019-02-27	4	-4/+61
\|\ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Show only MRs visible to user on milestone detail See merge request gitlab/gitlabhq!2923
\| * \| \| \| \|	Show only MRs visible to user on milestone detail	Jarka Košanová	2019-02-14	4	-4/+61
\| \|/ / / /
* \| \| \| \|	Merge branch 'security-commit-private-related-mr-11-8' into '11-8-stable'	Yorick Peterse	2019-02-27	6	-6/+65
\|\ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Don't allow non-members to see private related MRs See merge request gitlab/gitlabhq!2930
\| * \| \| \| \|	Don't allow non-members to see private related MRs	Patrick Bajao	2019-02-15	6	-6/+65
\| \| \| \| \| \|
* \| \| \| \| \|	Merge branch 'security-kubernetes-google-login-csrf-11-8' into '11-8-stable'	Yorick Peterse	2019-02-27	3	-30/+67
\|\ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Validate session key when authorizing with GCP to create a cluster See merge request gitlab/gitlabhq!2934
\| * \| \| \| \| \|	Validate session key when authorizing with GCP to create a cluster	Tiger	2019-02-19	3	-30/+67
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	It was previously possible to link a GCP account to another user's GitLab account by having them visit the callback URL, as there was no check that they were the initiator of the request. We now reject the callback unless the state parameter matches the one added to the initiating user's session.
* \| \| \| \| \| \|	Merge branch 'security-50334-11-8' into '11-8-stable'	Yorick Peterse	2019-02-27	5	-66/+82
\|\ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Fix git clone revealing private repo's presence See merge request gitlab/gitlabhq!2938
\| * \| \| \| \| \| \|	Fix git clone revealing private repo's presence	Mark Chao	2019-02-19	5	-66/+82
\| \|/ / / / / / \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Ensure redirection to path with .git suffix regardless whether project exists or not.
* \| \| \| \| \| \|	Merge branch 'security-56348-11-8' into '11-8-stable'	Yorick Peterse	2019-02-27	5	-2/+60
\|\ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Check snippet attached file to be moved is within designated directory See merge request gitlab/gitlabhq!2941
\| * \| \| \| \| \| \|	Check snippet attached file to be moved is within designated directory	Mark Chao	2019-02-21	5	-2/+60
\| \|/ / / / / / \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Previously one could move any temp/ sub folder around. Align spec with actual usage, as currently we pass temp file path to FileMover.
* \| \| \| \| \| \|	Merge branch 'security-55468-check-validity-before-querying-11-8' into ↵	Yorick Peterse	2019-02-27	3	-19/+53
\|\ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	'11-8-stable' Fix blind SSRF in Prometheus Integration See merge request gitlab/gitlabhq!2944
\| * \| \| \| \| \| \|	Check validity of prometheus_service before query	Reuben Pereira	2019-02-27	3	-19/+53
\|/ / / / / / / \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Check validity before querying so that if the dns entry for the api_url has been changed to something invalid after the model was saved and checked for validity, it will not query. This is to solve a toctou (time of check to time of use) issue.
* \| \| \| \| \| \|	Merge branch 'security-protect-private-repo-information-11-8' into '11-8-stable'	Yorick Peterse	2019-02-27	6	-22/+85
\|\ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Fix leaking private repository information in API See merge request gitlab/gitlabhq!2948
\| * \| \| \| \| \| \|	Add changelog entry	Luke Duncalfe	2019-02-21	1	-0/+5
\| \| \| \| \| \| \| \|
\| * \| \| \| \| \| \|	Removing sensitive properties from ProjectType	Luke Duncalfe	2019-02-20	1	-2/+0
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	defaultBranch and ciConfigPath should only be available to users with the :download_code permission for the Project, as the respository might be private. When implementing the authorize check on these properties, it was found that our current Graphql::Authorize::Instrumentation class does not work with fields that resolve to subclasses of GraphQL::Schema::Scalar, like GraphQL::STRING_TYPE. After discussion with other Create Team members, it has been decided that because the GraphQL API is not GA, to remove these properties from ProjectType, and instead implement them as part of epic https://gitlab.com/groups/gitlab-org/-/epics/711 Issue: https://gitlab.com/gitlab-org/gitlab-ce/issues/55316
\| * \| \| \| \| \| \|	Prevent leaking of private repo data through API	Luke Duncalfe	2019-02-20	4	-20/+80
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	default_branch, statistics and config_ci_path are now only exposed if the user has permissions to the repository.
* \| \| \| \| \| \| \|	Merge branch 'security-fj-diff-import-file-read-fix-11-8' into '11-8-stable'	Yorick Peterse	2019-02-27	10	-4/+103
\|\ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Arbitrary file read via MergeRequestDiff See merge request gitlab/gitlabhq!2951
\| * \| \| \| \| \| \| \|	Arbitrary file read via MergeRequestDiff	Francisco Javier López	2019-02-27	10	-4/+103
\|/ / / / / / / /
* \| \| \| \| \| \| \|	Merge branch '11-8-security-2799-emails' into '11-8-stable'	Yorick Peterse	2019-02-27	5	-17/+60
\|\ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Remove link after issue move when no permissions See merge request gitlab/gitlabhq!2955
\| * \| \| \| \| \| \| \|	Remove link after issue move when no permissions	Jarka Košanová	2019-02-22	5	-17/+60
\| \| \|_\|_\|_\|_\|_\|/ \| \|/\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Don't show new issue link after move when a user does not have permissions to display the new issue
* \| \| \| \| \| \| \|	Merge branch 'security-kubernetes-local-ssrf-11-8' into '11-8-stable'	Yorick Peterse	2019-02-27	5	-1/+60
\|\ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Block local URLs for Kubernetes integration See merge request gitlab/gitlabhq!2959
\| * \| \| \| \| \| \| \|	Do not allow local urls in Kubernetes form	Thong Kuah	2019-02-21	5	-1/+60
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Use existing `public_url` validation to block various local urls. Note that this validation will allow local urls if the "Allow requests to the local network from hooks and services" admin setting is enabled. Block KubeClient from using local addresses It will also respect `allow_local_requests_from_hooks_and_services` so if that is enabled KubeClinet will allow local addresses
* \| \| \| \| \| \| \| \|	Merge branch ↵	Yorick Peterse	2019-02-27	10	-13/+85
\|\ \ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	'security-add-public-internal-groups-as-members-to-your-project-idor-11-8' into '11-8-stable' Add public/internal groups as members to your Project(IDOR) See merge request gitlab/gitlabhq!2962
\| * \| \| \| \| \| \| \| \|	Change policy regarding group visibility	Małgorzata Ksionek	2019-02-20	10	-13/+85
\| \| \|_\|/ / / / / / \| \|/\| \| \| \| \| \| \|
* \| \| \| \| \| \| \| \|	Merge branch 'security-osw-stop-linking-to-packages-11-8' into '11-8-stable'	Yorick Peterse	2019-02-27	20	-51/+207
\|\ \ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Stop linking to unrecognized package sources See merge request gitlab/gitlabhq!2969
\| * \| \| \| \| \| \| \| \|	Add changelog	Oswaldo Ferreira	2019-02-26	1	-0/+5
\| \| \| \| \| \| \| \| \| \|
\| * \| \| \| \| \| \| \| \|	Raise not implemented error on BaseLinker for package_url	Oswaldo Ferreira	2019-02-25	1	-0/+4
\| \| \| \| \| \| \| \| \| \|
\| * \| \| \| \| \| \| \| \|	Stop linking to unrecognized package sources	Oswaldo Ferreira	2019-02-24	19	-51/+198
\| \| \|_\|/ / / / / / \| \|/\| \| \| \| \| \| \|
* \| \| \| \| \| \| \| \|	Merge branch 'security-issue_54789_2-11-8' into '11-8-stable'	Yorick Peterse	2019-02-27	3	-0/+44
\|\ \ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	[11.8] Prevent disclosing project milestone titles See merge request gitlab/gitlabhq!2973
\| * \| \| \| \| \| \| \| \|	Prevent disclosing project milestone titles	Felipe Artur	2019-02-25	3	-0/+44
\| \|/ / / / / / / / \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Prevent unauthorized users having access to milestone titles through autocomplete endpoint.
* \| \| \| \| \| \| \| \|	Merge branch 'security-mermaid-11-8' into '11-8-stable'	Yorick Peterse	2019-02-27	3	-0/+27
\|\ \ \ \ \ \ \ \ \ \| \|/ / / / / / / / \|/\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Limit number of characters allowed in mermaidjs See merge request gitlab/gitlabhq!2978
\| * \| \| \| \| \| \| \|	Limit number of characters allowed in mermaidjs	Rajat Jain	2019-02-27	3	-0/+27
\| \| \|/ / / / / / \| \|/\| \| \| \| \| \|