summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
| * | | | | | | | Use clock_gettime for all performance timestampsperformance-clock-adjustmentsYorick Peterse2016-06-285-21/+48
| | |/ / / / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Process.clock_gettime allows getting the real time in nanoseconds as well as allowing one to get a monotonic timestamp. This offers greater accuracy without the overhead of having to allocate a Time instance. In general using Time.now/Time.new is about 2x slower than using Process.clock_gettime(). For example: require 'benchmark/ips' Benchmark.ips do |bench| bench.report 'Time.now' do Time.now.to_f end bench.report 'clock_gettime' do Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond) end bench.compare! end Running this benchmark gives: Calculating ------------------------------------- Time.now 108.052k i/100ms clock_gettime 125.984k i/100ms ------------------------------------------------- Time.now 2.343M (± 7.1%) i/s - 11.670M clock_gettime 4.979M (± 0.8%) i/s - 24.945M Comparison: clock_gettime: 4979393.8 i/s Time.now: 2342986.8 i/s - 2.13x slower Another benefit of using Process.clock_gettime() is that we can simplify the code a bit since it can give timestamps in nanoseconds out of the box.
* | | | | | | | Merge branch ↵Jacob Schatz2016-06-285-106/+180
|\ \ \ \ \ \ \ \ | |/ / / / / / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'lbennett/gitlab-ce-2542-implement-updated-ui-for-new-project-page' into 'master' Implement UI for new project page ## What does this MR do? Updates the project creation page to conform with the latest UI updates. ## Are there points in the code the reviewer needs to double check? Ney. ## Why was this MR needed? Updated UI. ## What are the relevant issue numbers? Closes #2542. ## Screenshots (if relevant) **Desktop:** ![Screen_Shot_2016-06-18_at_04.00.48](/uploads/0313eee96a2aef9ed5e048989548b133/Screen_Shot_2016-06-18_at_04.00.48.png) **Mobile:** ![Screen_Shot_2016-06-18_at_04.01.00](/uploads/505b110c3fcbf523aac08797db9f6781/Screen_Shot_2016-06-18_at_04.01.00.png) See merge request !4766
| * | | | | | | Wiped old page and started on new UIlbennett/gitlab-ce-2542-implement-updated-ui-for-new-project-pageLuke "Jared" Bennett2016-06-285-106/+180
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Completed new project page Updated CHANGELOG Corrected 'Create project' button Made responsive Added gitlab export button Changed Spinach test to match updated UI reverted test changes and fixed UI Corrected 'Repo by URL' text Fixed static namespace style Added errors partial Added padding to bottom of page-with-sidebar
* | | | | | | | Merge branch 'remove-gon-variable' into 'master' Fatih Acet2016-06-282-1/+1
|\ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Unused gon variable with very bad performance ## What does this MR do? Remove an unused variable with a lot of performance penalty. It was opening a transaction just to return a constant string. ## Does this MR meet the acceptance criteria? - [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added See merge request !4969
| * | | | | | | | Unused got variable with very bad performancePaco Guzman2016-06-282-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In any case if just want the value which is always ‘gitlab’ require 'benchmark/ips' Project.first # To load database things GitlabIssueTrackerService.first # To load database things Benchmark.ips do |x| x.config(:time => 5, :warmup => 2) x.report("current") do Project.new.default_issue_tracker.to_param end x.report("") do 'gitlab' end x.compare! end Calculating ------------------------------------- current 4.000 i/100ms 30.938k i/100ms ------------------------------------------------- current 47.298 (±10.6%) i/s - 232.000 4.366M (±20.9%) i/s - 17.202M Comparison: : 4366456.0 i/s current: 47.3 i/s - 92318.26x slower
* | | | | | | | | Merge branch 'iankelling-api-doc' into 'master' Achilleas Pipinellis2016-06-281-1/+1
|\ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | docs: fix default_branch_protection default See merge request !4479
| * | | | | | | | | docs: fix default_branch_protection defaultIan Kelling2016-06-051-1/+1
| | | | | | | | | |
* | | | | | | | | | Merge branch '19170-mobile-buttons' into 'master' Dmitriy Zaporozhets2016-06-289-15/+15
|\ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Switched mobile button icons to ellipsis and angle ## What does this MR do? Switches the mobile button icons ## What are the relevant issue numbers? Closes #19170 Part of #19200 ## Screenshots (if relevant) ![Screen_Shot_2016-06-27_at_9.08.28_AM](/uploads/7784489402e342e671d02b24d2ea0d64/Screen_Shot_2016-06-27_at_9.08.28_AM.png) See merge request !4944
| * | | | | | | | | | Update CHANGELOGAlfredo Sumaran2016-06-281-3/+2
| | | | | | | | | | |
| * | | | | | | | | | Switched mobile button icons to ellipsis and angleAnnabel Dunstone2016-06-289-15/+16
|/ / / / / / / / / /
* | | | | | | | | | Merge branch '19171-pinned-width' into 'master' Dmitriy Zaporozhets2016-06-283-2/+3
|\ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolve "Pin should show up at 1280px min" ## What does this MR do? Decreased window min width for pinned sidebar ## What are the relevant issue numbers? Closes #19171 Part of #19200 ## Screenshots (if relevant) ![Screen_Shot_2016-06-27_at_9.36.13_AM](/uploads/d0a87bca5af1bee808c5b1046c0ecf72/Screen_Shot_2016-06-27_at_9.36.13_AM.png) See merge request !4947
| * | | | | | | | | | Update CHANGELOG19171-pinned-widthAnnabel Dunstone2016-06-281-0/+1
| | | | | | | | | | |
| * | | | | | | | | | Decreased window min width for pinned sidebarAnnabel Dunstone2016-06-282-2/+2
| | |/ / / / / / / / | |/| | | | | | | |
* | | | | | | | | | Merge branch 'use-git-depth' into 'master' Kamil Trzciński2016-06-281-0/+1
|\ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use GIT_DEPTH for builds ## What does this MR do? Enables experimental feature to use shallow cloning. ## Why was this MR needed? To speed up the builds and reduce the pressure on NFS servers. This should save us between 30s to 1m of the time of each build. ## More information `GIT_DEPTH`: https://gitlab.com/gitlab-org/gitlab-ci-multi-runner/merge_requests/188 ## Problems - Too small value for `GIT_DEPTH` can make it impossible to retry old changes. You will see `unresolved reference` in build log. We should then reconsider changing `GIT_DEPTH` to higher value - Mechanism that rely on `git describe` may not work correctly when `GIT_DEPTH` is set. This will happen, because only part of the git history is present on the build machine ## Requirements GitLab Runner 1.3.0. Currently all our internal runners use beta release or 1.3.0 with support for `GIT_DEPTH`. @pcarranza Please decide when to merge that. We should start monitoring to see an impact on our NFS servers. cc @jacobvosmaer-gitlab @pcarranza See merge request !4730
| * | | | | | | | | | Use GIT_DEPTH when running buildsuse-git-depthKamil Trzcinski2016-06-171-0/+1
| | | | | | | | | | |
* | | | | | | | | | | Merge branch 'add-smtp-upgrade-info' into 'master' Achilleas Pipinellis2016-06-281-0/+13
|\ \ \ \ \ \ \ \ \ \ \ | |_|/ / / / / / / / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add SMTP upgrade information 8.8 to 8.9 requires an update to the SMTP settings for source installs. See merge request !4966
| * | | | | | | | | | Add SMTP upgrade informationStan Hu2016-06-281-0/+13
| | |_|/ / / / / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Closes #19252 [ci skip]
* | | | | | | | | | Merge branch 'gitlab_architecture' into 'master' Achilleas Pipinellis2016-06-283-1/+3
|\ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Refactor GitLab architecture document Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/14236 See merge request !3694
| * | | | | | | | | | Add "GitLab team members only" to diagram linkgitlab_architectureChris Wilson2016-06-281-1/+1
| | | | | | | | | | |
| * | | | | | | | | | Update GitLab architecture diagram, include Google draw linkChris Wilson2016-06-232-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ci skip]
| * | | | | | | | | | Replace GitLab architecture diagramAchilleas Pipinellis2016-04-133-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ci skip]
* | | | | | | | | | | Merge branch 'display-deleted-ref-in-events' into 'master' Rémy Coutable2016-06-283-9/+19
|\ \ \ \ \ \ \ \ \ \ \ | |_|_|_|_|/ / / / / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Display last commit of deleted branch in push events ## What does this MR do? Display the last commit of a deleted branch in the push events of a project. ## Are there points in the code the reviewer needs to double check? Is the change in `app/models/event.rb` the correct way to display a two-line event for deleted branches? ## Why was this MR needed? It is easier to restore an accidentally deleted branch if the commit hash is displayed in the push events. ## What are the relevant issue numbers? Fixes #18659 ## Screenshots ### Before garbage collection ![before-gc](/uploads/5674cd53e1564d48b7f2f8406ea0fbed/before-gc.png) ### After garbage collection ![after-gc](/uploads/80950c1932feeb3b69d0fc11b8f7acf4/after-gc.png) See merge request !4699
| * | | | | | | | | | Display last commit of deleted branch in push events (!4699)winniehell2016-06-283-9/+19
| | |_|_|_|_|_|/ / / | |/| | | | | | | |
* | | | | | | | | | Merge branch 'fix/attr-encrypted-issue' into 'master' Rémy Coutable2016-06-284-0/+6
|\ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix encrypted data backwards compatibility after upgrading attr_encrypted gem Adds missing attribute to attr_encrypted so it is fully backwards-compatible. Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/19073 See merge request !4963
| * | | | | | | | | | add changelogJames Lopez2016-06-281-0/+3
| | | | | | | | | | |
| * | | | | | | | | | add missing attribute to attr_encrypted so it is fully backwards-compatibleJames Lopez2016-06-283-0/+3
| | |_|/ / / / / / / | |/| | | | | | | |
* | | | | | | | | | Merge branch 'feature/custom-highlighting' into 'master' Rémy Coutable2016-06-2810-12/+101
|\ \ \ \ \ \ \ \ \ \ | |/ / / / / / / / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add custom highlighting via .gitattributes ## What does this MR do? Allows user control of language selection via a `gitlab-language` entry in `.gitattributes` ## Are there points in the code the reviewer needs to double check? (paired with @stanhu) ## Why was this MR needed? Guessing languages by filename is fraught and often wrong. In one project, `foo.pl` may be perl, and in another it may be prolog. Users might have a Thingfile that needs ruby highlighting, or depend on things that can't work in general, like `*.C` (capitalized) mapping to C++ instead of C. This allows the user to override language choice so they never have to look at a mis-highlighted file. ## What are the relevant issue numbers? https://github.com/jneen/rouge/issues/494 https://gitlab.com/gitlab-org/gitlab-ce/issues/13818 (*.tpl can't in general map to Smarty) https://gitlab.com/gitlab-org/gitlab-ce/issues/13615 (in cases we don't have a language and mis-identify it, users could map to 'text' to turn off highlighting) ## Screenshots (if relevant) ## Does this MR meet the acceptance criteria? - [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added - [x] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md) - [x] API support added (N/A) - [x] Tests - [x] Added for this feature/bug - [x] All builds are passing - [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides) - [x] Branch has no merge conflicts with `master` (if you do - rebase it please) - [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits) See merge request !4606
| * | | | | | | | | doc: note that .gitattributes uses default branchfeature/custom-highlightinghttp://jneen.net/2016-06-271-0/+2
| | | | | | | | | |
| * | | | | | | | | use the conf lexer so we have highlighted commentshttp://jneen.net/2016-06-271-1/+1
| | | | | | | | | |
| * | | | | | | | | first draft of docshttp://jneen.net/2016-06-271-0/+29
| | | | | | | | | |
| * | | | | | | | | support cgi style options, such as erb?parent=jsonhttp://jneen.net/2016-06-273-7/+18
| | | | | | | | | |
| * | | | | | | | | move the path alias to a more appropriate locationhttp://jneen.net/2016-06-271-5/+5
| | | | | | | | | |
| * | | | | | | | | make #custom_language privatehttp://jneen.net/2016-06-271-8/+8
| | | | | | | | | |
| * | | | | | | | | appease rubocophttp://jneen.net/2016-06-271-2/+1
| | | | | | | | | |
| * | | | | | | | | add an alias for Snippet#pathhttp://jneen.net/2016-06-271-0/+6
| | | | | | | | | |
| * | | | | | | | | appease rubocophttp://jneen.net/2016-06-271-2/+2
| | | | | | | | | |
| * | | | | | | | | check the tag so that an instance will pass toohttp://jneen.net/2016-06-271-1/+1
| | | | | | | | | |
| * | | | | | | | | fix the spec, using project.change_headhttp://jneen.net/2016-06-272-3/+10
| | | | | | | | | |
| * | | | | | | | | Revert "bump the master sha for gitlab-test!9"http://jneen.net/2016-06-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit b435d7405364d28ec364072f4437512da2876762.
| * | | | | | | | | bump the master sha for gitlab-test!9http://jneen.net/2016-06-271-1/+1
| | | | | | | | | |
| * | | | | | | | | add custom highlighting via .gitattributeshttp://jneen.net/2016-06-277-12/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | paired with @stanhu
* | | | | | | | | | Merge remote-tracking branch 'dev/master'Robert Speicher2016-06-2710-9/+154
|\ \ \ \ \ \ \ \ \ \ | |/ / / / / / / / / |/| | | | | | | | |
| * | | | | | | | | Merge branch 'fix-18997' into 'master' Robert Speicher2016-06-274-2/+113
| |\ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix visibility of snippets when searching Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/18997 See merge request !1972
| | * | | | | | | | | Update CHANGELOGDouglas Barbosa Alexandre2016-06-221-0/+3
| | | | | | | | | | |
| | * | | | | | | | | Fix visibility of private project snippets for members when searchingDouglas Barbosa Alexandre2016-06-223-20/+68
| | | | | | | | | | |
| | * | | | | | | | | Fix internal snippets can be searched by anyoneDouglas Barbosa Alexandre2016-06-223-2/+62
| | | | | | | | | | |
| * | | | | | | | | | Merge branch '19102-fix' into 'master' Robert Speicher2016-06-276-6/+42
| |\ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix an information disclosure when requesting access to a group containing private projects Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/19102. The commit speaks for itself: Fix an information disclosure when requesting access to a group containing private projects The issue was with the `User#groups` and `User#projects` associations which goes through the `User#group_members` and `User#project_members`. Initially I chose to use a secure approach by storing the requester's user ID in `Member#created_by_id` instead of `Member#user_id` because I was aware that there was a security risk since I didn't know the codebase well enough. Then during the review, we decided to change that and directly store the requester's user ID into `Member#user_id` (for the sake of simplifying the code I believe), meaning that every `group_members` / `project_members` association would include the requesters by default... My bad for not checking that all the `group_members` / `project_members` associations and the ones that go through them (e.g. `Group#users` and `Project#users`) were made safe with the `where(requested_at: nil)` / `where(members: { requested_at: nil })` scopes. Now they are all secure. See merge request !1973
| | * | | | | | | | | | Fix an information disclosure when requesting access to a group containing ↵Rémy Coutable2016-06-246-6/+42
| | | |/ / / / / / / / | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | private projects The issue was with the `User#groups` and `User#projects` associations which goes through the `User#group_members` and `User#project_members`. Initially I chose to use a secure approach by storing the requester's user ID in `Member#created_by_id` instead of `Member#user_id` because I was aware that there was a security risk since I didn't know the codebase well enough. Then during the review, we decided to change that and directly store the requester's user ID into `Member#user_id` (for the sake of simplifying the code I believe), meaning that every `group_members` / `project_members` association would include the requesters by default... My bad for not checking that all the `group_members` / `project_members` associations and the ones that go through them (e.g. `Group#users` and `Project#users`) were made safe with the `where(requested_at: nil)` / `where(members: { requested_at: nil })` scopes. Now they are all secure. Signed-off-by: Rémy Coutable <remy@rymai.me>
* | | | | | | | | | | Merge branch 'rename_license_template_api' into 'master' Robert Speicher2016-06-273-4/+4
|\ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rename Licenses API to License Templates API ## What does this MR do? Earlier I renamed this in EE, thinking license templates was an EE-only feature. This backports that change to CE. Thanks to @vsizov for pointing out this error. See https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/400 for the EE merge request. See merge request !4957
| * | | | | | | | | | | Rename Licenses API to License Templates APIDrew Blessing2016-06-273-4/+4
|/ / / / / / / / / / /