summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* Update VERSION to 11.4.8v11.4.8GitLab Release Tools Bot2018-11-271-1/+1
|
* Update CHANGELOG.md for 11.4.8GitLab Release Tools Bot2018-11-2725-122/+30
| | | [ci skip]
* Merge branch 'security-11-4-fix-webhook-ssrf-ipv6' into 'security-11-4'Steve Azzopardi2018-11-263-13/+114
|\ | | | | | | | | [11.4] Fix SSRF in project integrations See merge request gitlab/gitlabhq!2610
| * Fix SSRF in project integrationsFrancisco Javier López2018-11-263-13/+114
| | | | | | | | | | | | This commit fixes a SSRF vulnerability related to project hooks and ipv6 addresses. It also addresses a problem with ipv6 mapped addresses.
* | Merge branch 'security-fix-uri-xss-applications-11-4' into 'security-11-4'Steve Azzopardi2018-11-267-2/+121
|\ \ | | | | | | | | | | | | [11.4] Reflected XSS in OAuth Authorize window due to redirect_uri allowing arbitrary protocols See merge request gitlab/gitlabhq!2580
| * | Resolve reflected XSS in Ouath authorize windowJames Lopez2018-11-267-2/+121
| | |
* | | Merge branch 'security-11-4-fj-crlf-injection' into 'security-11-4'Steve Azzopardi2018-11-265-39/+113
|\ \ \ | |_|/ |/| | | | | | | | [11.4] Fix CRLF issue in UrlValidator See merge request gitlab/gitlabhq!2653
| * | [11.4] Fix CRLF issue in UrlValidatorFrancisco Javier López2018-11-265-39/+113
|/ /
* | Merge branch '11-4-stable' into security-11-4Steve Azzopardi2018-11-261-1/+2
|\ \
| * \ Merge branch 'charts-gitlab-937-pass-compile-assets' into '11-4-stable'Rémy Coutable2018-11-211-1/+2
| |\ \ | | | | | | | | | | | | | | | | ci: Add COMPILE_ASSETS to cng build trigger See merge request gitlab-org/gitlab-ce!23253
| | * | CI: Add COMPILE_ASSETS to cng build triggercharts-gitlab-937-pass-compile-assetsJason Plum2018-11-201-1/+2
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | Add `COMPILE_ASSETS=true` to CNG build trigger. This stems from https://gitlab.com/charts/gitlab/issues/937, where we needed to add asset compilation to the CNG image pipelines when using `<= 11.5.x`. This is only needed on versions prior to `11.5`, as they do not have the asset compilation container backported.
* | | Merge branch 'security-email-change-notification-11-4' into 'security-11-4'Steve Azzopardi2018-11-265-0/+32
|\ \ \ | |_|/ |/| | | | | | | | [11.4] Resolve: "Provide email notification when a user changes their email address" See merge request gitlab/gitlabhq!2603
| * | Provide email notification on email updatesJames Lopez2018-11-125-0/+32
| | |
* | | Merge branch 'security-guest-comments-11-4' into 'security-11-4'Steve Azzopardi2018-11-2613-34/+187
|\ \ \ | | | | | | | | | | | | | | | | [11.4] Fixed ability to comment on and edit/delete comments on locked or confidential issues See merge request gitlab/gitlabhq!2647
| * | | [11.4] Fixed ability to comment on and edit/delete comments on locked or ↵Chantal Rollison2018-11-2613-34/+187
|/ / / | | | | | | | | | confidential issues
* | | Merge branch 'security-11-4-pages-toctou-race' into 'security-11-4'Steve Azzopardi2018-11-262-1/+7
|\ \ \ | | | | | | | | | | | | | | | | [11.4] [pages] Possible symlink time of check to time of use race condition See merge request gitlab/gitlabhq!2650
| * | | Upgrade GitLab Pages to v1.1.1Alessio Caiazza2018-11-212-1/+7
| | | |
* | | | Merge branch 'security-fix-pat-web-access-11-4' into 'security-11-4'Steve Azzopardi2018-11-2628-277/+538
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | [11.4] Resolve "Personal access token with only `read_user` scope can be used to authenticate any web request" See merge request gitlab/gitlabhq!2656
| * | | | Update code to use API scope on PAT authJames Lopez2018-11-2328-277/+538
| |/ / /
* | | | Merge branch ↵Steve Azzopardi2018-11-235-2/+25
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'security-11-4-xss-in-markdown-following-unrecognized-html-element' into 'security-11-4' [11.4] XSS in markdown following unrecognized HTML element See merge request gitlab/gitlabhq!2632
| * | | | Sanitize output of SpacedLinkFilterBrett Walker2018-11-165-2/+25
| | | | |
* | | | | Merge branch 'security-mermaid-xss-11-4' into 'security-11-4'Steve Azzopardi2018-11-234-1/+21
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | [11.4] Fix XSS in mermaid diagrams See merge request gitlab/gitlabhq!2622
| * | | | | Configure mermaid to not render HTML content in diagramsWinnie Hellmann2018-11-142-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | (cherry picked from commit f2e9f22f7d3d84abeea5ba2918ee5ffcc55f2dad) Conflicts: app/assets/javascripts/behaviors/markdown/render_mermaid.js
| * | | | | Add failing test for XSS in mermaid diagramsWinnie Hellmann2018-11-142-1/+13
| |/ / / / | | | | | | | | | | | | | | | (cherry picked from commit fdea799d37ae9ca3f5e80f191a55be543a79857a)
* | | | | Merge branch 'security-bvl-exposure-in-commits-list-11-4' into 'security-11-4'Steve Azzopardi2018-11-233-55/+67
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | [11.4] Don't expose confidential information in commit message list See merge request gitlab/gitlabhq!2643
| * | | | | Don't use fragment cache on commit pageBob Van Landuyt2018-11-193-55/+67
| | |/ / / | |/| | | | | | | | | | | | | | | | | | This makes sure the user viewing the commit does not get to see anything they're not allowed to see
* | | | | Merge branch 'security-issue_51301-11-4' into 'security-11-4'Steve Azzopardi2018-11-236-12/+96
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | [11.4] Resolve: Promoting a milestone is missing an authorization check See merge request gitlab/gitlabhq!2620
| * | | | | Fix milestone promotion authorizationFelipe Artur2018-11-146-12/+96
| | |_|/ / | |/| | | | | | | | | | | | | | | | | | Promoting milestone was missing an authorization check, guest users were being able to promote project milestones to group milestones.
* | | | | Merge branch 'security-2736-prometheus-ssrf-11-4' into 'security-11-4'Steve Azzopardi2018-11-234-3/+25
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | [11.4] Do not follow redirects in prometheus service See merge request gitlab/gitlabhq!2624
| * | | | | No redirects in prometheus servicerpereira22018-11-144-3/+25
| | |_|/ / | |/| | | | | | | | | | | | | Do not allow redirects in the prometheus service to prevent SSRFs.
* | | | | Merge branch 'security-11-4-stored-xss-for-environments' into 'security-11-4'Steve Azzopardi2018-11-237-6/+67
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | [11.4] Stored XSS for Environments See merge request gitlab/gitlabhq!2615
| * | | | | Validate URI scheme also for internal URIAlessio Caiazza2018-11-157-6/+67
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a backport for 11.4 stable branch. Gitlab::UrlBlocker ignores scheme when validating URI matching either config.gitlab or config.gitlab_shell This patch enforces matching config.gitlab.protocol for internal web and ssh for internal shell. A cleanup migration for stored XSS from environments table is included.
* | | | | Merge branch '11-4-stable' into security-11-4Steve Azzopardi2018-11-232-1/+12
|\ \ \ \ \ | | |_|_|/ | |/| | |
| * | | | Update VERSION to 11.4.7v11.4.7GitLab Release Tools Bot2018-11-201-1/+1
| | | | |
| * | | | Update CHANGELOG.md for 11.4.7GitLab Release Tools Bot2018-11-201-0/+4
| | | | | | | | | | | | | | | [ci skip]
| * | | | Update VERSION to 11.4.6v11.4.611-4-stable-patch-7GitLab Release Tools Bot2018-11-181-1/+1
| | | | |
| * | | | Update CHANGELOG.md for 11.4.6GitLab Release Tools Bot2018-11-182-5/+7
| | | | | | | | | | | | | | | [ci skip]
| * | | | Merge branch 'sh-fix-issue-54189-11-4' into 'security-11-4'Steve Azzopardi2018-11-184-1/+37
| | | | | | | | | | | | | | | | | | | | | | | | | [11.4] Prevent templated services from being imported See merge request gitlab/gitlabhq!2636
| * | | | Merge branch 'security-11-4-2717-xss-username-autocomplete' into 'security-11-4'Steve Azzopardi2018-11-183-11/+40
| | | | | | | | | | | | | | | | | | | | | | | | | [11.4] Escape user fullname while rendering autocomplete template to prevent XSS See merge request gitlab/gitlabhq!2607
* | | | | Merge branch 'security-private-group-11-4' into 'security-11-4'Steve Azzopardi2018-11-233-0/+26
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | [11.4] Fixed read name of private groups See merge request gitlab/gitlabhq!2591
| * | | | | Fixed read name of private groupsChantal Rollison2018-11-073-0/+26
| | |_|/ / | |/| | |
* | | | | Merge branch 'security-182-update-workhorse-11-4' into 'security-11-4'Steve Azzopardi2018-11-233-1/+8
|\ \ \ \ \ | |_|_|_|/ |/| | | | | | | | | | | | | | [11.4] Redact sensitive information on gitlab-workhorse log See merge request gitlab/gitlabhq!2585
| * | | | Redact sensitive information on workhorse logMark Chao2018-11-053-1/+8
| |/ / /
* | | | Merge branch 'sh-fix-issue-54189-11-4' into 'security-11-4'Steve Azzopardi2018-11-184-1/+37
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | [11.4] Prevent templated services from being imported See merge request gitlab/gitlabhq!2636
| * | | | Prevent templated services from being importedStan Hu2018-11-184-1/+37
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Templated services should only be created by admins and does not apply to project import/export. Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/54189
* | | | | Merge branch 'security-11-4-2717-xss-username-autocomplete' into 'security-11-4'Steve Azzopardi2018-11-183-11/+40
|\ \ \ \ \ | |_|_|_|/ |/| | | | | | | | | | | | | | [11.4] Escape user fullname while rendering autocomplete template to prevent XSS See merge request gitlab/gitlabhq!2607
| * | | | Add changelog entryKushal Pandya2018-11-121-0/+5
| | | | |
| * | | | Fix user name autocomplete XSS when name contains HTMLKushal Pandya2018-11-122-11/+35
| | |/ / | |/| |
* | | | Merge remote-tracking branch 'dev.gitlab.org/11-4-stable' into security-11-4Winnie Hellmann2018-11-14253-1136/+758
|\ \ \ \ | |/ / / |/| | / | | |/ | |/|
| * | Update VERSION to 11.4.5v11.4.5GitLab Release Tools Bot2018-11-041-1/+1
| | |
View Lorry Controller Status