summaryrefslogtreecommitdiff
path: root/app/finders
Commit message (Collapse)AuthorAgeFilesLines
* Allow filtering by all started milestonesbetter-priority-sortingSean McGivern2017-03-151-0/+6
|
* Show members of parent groups on project members pagedz-nested-groups-membersDmitriy Zaporozhets2017-03-092-10/+32
| | | | Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
* Merge remote-tracking branch ↵Douwe Maan2017-03-071-0/+45
|\ | | | | | | 'origin/personal_access_token_api_and_impersonation_token'
| * apply codestyle and implementation changes to the respective feature codepersonal_access_token_api_and_impersonation_tokenTiago Botelho2017-03-061-16/+14
| |
| * refactors finder and correlated codeTiago Botelho2017-03-011-25/+31
| |
| * applies relevant changes to the code and code structureTiago Botelho2017-02-281-0/+41
| |
* | Improve issues filtering performanceJarka Kadlecova2017-03-063-14/+31
|/
* Revert "Enable Style/DotPosition"Douwe Maan2017-02-231-5/+5
| | | | | | | | | | | | | | | This reverts commit e00fb2bdc2090e9cabeb1eb35a2672a882cc96e9. # Conflicts: # .rubocop.yml # .rubocop_todo.yml # lib/gitlab/ci/config/entry/global.rb # lib/gitlab/ci/config/entry/jobs.rb # spec/lib/gitlab/ci/config/entry/factory_spec.rb # spec/lib/gitlab/ci/config/entry/global_spec.rb # spec/lib/gitlab/ci/config/entry/job_spec.rb # spec/lib/gitlab/ci/status/build/factory_spec.rb # spec/lib/gitlab/incoming_email_spec.rb
* Revert "Prefer leading style for Style/DotPosition"Douwe Maan2017-02-232-8/+8
| | | | This reverts commit cb10b725c8929b8b4460f89c9d96c773af39ba6b.
* Enable Style/WordArrayDouwe Maan2017-02-231-1/+1
|
* Prefer leading style for Style/DotPositionDouwe Maan2017-02-232-8/+8
|
* Fix code for copsDouwe Maan2017-02-231-5/+6
|
* Enable Style/ConditionalAssignmentDouwe Maan2017-02-231-3/+3
|
* Enable Style/MutableConstantDouwe Maan2017-02-232-2/+2
|
* Enable Style/DotPositionDouwe Maan2017-02-231-5/+5
|
* Merge branch 'master' into 26900-pipelines-tabs26900-pipelines-tabsFilipa Lacerda2017-02-233-23/+6
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * master: (361 commits) Code style improvements remove require.context from network_bundle remove require.context from graphs_bundle remove require.context from filtered_search_bundle Ignore two Rails CVEs in bundler:audit job Remove Pages readme Change Pages redirect Add missing index.md to Pages docs Added double newline after file upload markdown insert Reorder main index items in Pages overview remove html comments remove <> wrapping text - part 3 wrapping text - part 2 [ci skip] fix link wrap text - part 1 - [ci skip] typo fix spelling, add intermediate cert link Improve `Gitlab::EeCompatCheck` by using the `git apply --3way` flag remove link to unfinished video ...
| * add a :iids param to IssuableFindermhasbini2017-02-173-23/+6
| |
* | Adds Pending and Finished tabs to pipelines pageFilipa Lacerda2017-02-161-1/+5
|/ | | | Fix broken test
* Show parent group members for nested groupdz-nested-groups-members-pageDmitriy Zaporozhets2017-02-101-0/+20
| | | | Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
* Store group and project full name and full path in routes tabledz-refactor-full-pathDmitriy Zaporozhets2017-02-082-2/+2
| | | | Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
* Merge branch 'route-map' into 'master' Robert Speicher2017-02-071-0/+55
|\ | | | | | | | | Add 'View on [env]' link to blobs and individual files in diffs See merge request !8867
| * Move permission check before more expensive checksroute-mapDouwe Maan2017-02-071-3/+5
| |
| * Don't skip authorization when stopping CI environmentsDouwe Maan2017-02-071-7/+3
| |
| * Address feedbackDouwe Maan2017-02-061-0/+57
| |
* | List all groups/projects for admins on explore pagesDouwe Maan2017-02-061-1/+1
|/
* Add comments to issuable finderClement Ho2017-01-101-0/+2
|
* Make sure we could query against no oneLin Jen-Shin2017-01-091-0/+12
| | | | | We should separate the idea of not finding anyone, and the idea of against no one.
* Show no issues if author/assignee cannot be foundLin Jen-Shin2017-01-091-8/+12
| | | | | Feedback: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7345/diffs#note_19994225
* Check if it's not NONE tooLin Jen-Shin2017-01-091-6/+6
| | | | | | | | So that we don't have to check it again in somewhere else, and we don't really need to know if it's presented as NONE Feedback: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7345/diffs#note_20123999
* Add author_username and assignee_usernameClement Ho2017-01-091-6/+18
|
* Removed the "Groups" option from the settings gearJose Ivan Vargas2017-01-031-5/+5
| | | | Fixed more tests
* Added groups to members section, added a members finderJose Ivan Vargas2017-01-031-0/+13
|
* Merge branch 'jej-24637-move-issue-visible_to_user-to-finder' into 'security' Sean McGivern2016-12-151-1/+17
| | | | | | | Issue#visible_to_user moved to IssuesFinder Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/24637. See merge request !2039
* Merge branch 'jej-note-search-uses-finder' into 'security' Douwe Maan2016-12-151-19/+94
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix missing Note access checks in by moving Note#search to updated NoteFinder Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867 ## Which fixes are in this MR? :warning: - Potentially untested :bomb: - No test coverage :traffic_light: - Test coverage of some sort exists (a test failed when error raised) :vertical_traffic_light: - Test coverage of return value (a test failed when nil used) :white_check_mark: - Permissions check tested ### Note lookup without access check - [x] :white_check_mark: app/finders/notes_finder.rb:13 :download_code check - [x] :white_check_mark: app/finders/notes_finder.rb:19 `SnippetsFinder` - [x] :white_check_mark: app/models/note.rb:121 [`Issue#visible_to_user`] - [x] :white_check_mark: lib/gitlab/project_search_results.rb:113 - This is the only use of `app/models/note.rb:121` above, but importantly has no access checks at all. This means it leaks MR comments and snippets when those features are `team-only` in addition to the issue comments which would be fixed by `app/models/note.rb:121`. - It is only called from SearchController where `can?(current_user, :download_code, @project)` is checked, so commit comments are not leaked. ### Previous discussions - [x] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b915c5267a63628b0bafd23d37792ae73ceae272_13_13 `: download_code` check on commit - [x] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b915c5267a63628b0bafd23d37792ae73ceae272_19_19 `SnippetsFinder` should be used - `SnippetsFinder` should check if the snippets feature is enabled -> https://gitlab.com/gitlab-org/gitlab-ce/issues/25223 ### Acceptance criteria met? - [x] Tests added for new code - [x] TODO comments removed - [x] Squashed and removed skipped tests - [x] Changelog entry - [ ] State Gitlab versions affected and issue severity in description - [ ] Create technical debt issue for NotesFinder. - Either split into `NotesFinder::ForTarget` and `NotesFinder::Search` or consider object per notable type such as `NotesFinder::OnIssue`. For the first option could create `NotesFinder::Base` which is either inherited from or which can be included in the other two. - Avoid case statement anti-pattern in this finder with use of `NotesFinder::OnCommit` etc. Consider something on the finder for this? `Model.finder(user, project)` - Move `inc_author` to the controller, and implement `related_notes` to replace `non_diff_notes`/`mr_and_commit_notes` See merge request !2035
* Merge branch '19990-update-snippets-page-design' into 'master' Fatih Acet2016-12-121-21/+21
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolve "Updated UI for Snippets pages" ## What does this MR do? ## Are there points in the code the reviewer needs to double check? ## Why was this MR needed? ## Screenshots (if relevant) ## Does this MR meet the acceptance criteria? - [ ] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added - [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md) - [ ] API support added - Tests - [ ] Added for this feature/bug - [ ] All builds are passing - [ ] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html) - [ ] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides) - [ ] Branch has no merge conflicts with `master` (if it does - rebase it please) - [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits) ## What are the relevant issue numbers? Closes #19990 See merge request !7861
| * use Snippet.none in favor of nil to allow chainingMike Greiling2016-12-101-1/+1
| |
| * refactor duplicate code into a by_scope methodMike Greiling2016-12-101-35/+19
| |
| * add scope filters to project snippets pageMike Greiling2016-12-101-4/+20
| |
* | Merge branch 'features/api-snippets' into 'master' Sean McGivern2016-12-121-1/+4
|\ \ | |/ |/| | | | | | | | | Adding support for personal snippet endpoint on the API Closes #22042 See merge request !6373
| * API: Endpoint to expose personal snippets as /snippetsGuyzmo2016-12-011-1/+4
| | | | | | | | | | | | | | | | | | | | Adding the necessary API for the new /snippets Restful resource added with this commit. Added a new Grape class `Snippets`, as well as a `PersonalSnippet` entity. Issue: #20042 Merge-Request: !6373 Signed-off-by: Guyzmo <guyzmo+gitlab+pub@m0g.net>
* | Merge branch 'jej-23867-use-mr-finder-instead-of-access-check' into 'security'Douwe Maan2016-12-082-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace MR access checks with use of MergeRequestsFinder Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867 :warning: - Potentially untested :bomb: - No test coverage :traffic_light: - Test coverage of some sort exists (a test failed when error raised) :vertical_traffic_light: - Test coverage of return value (a test failed when nil used) :white_check_mark: - Permissions check tested - [x] :bomb: app/finders/notes_finder.rb:17 - [x] :warning: app/views/layouts/nav/_project.html.haml:80 [`.count`] - [x] :bomb: app/controllers/concerns/creates_commit.rb:84 - [x] :traffic_light: app/controllers/projects/commits_controller.rb:24 - [x] :traffic_light: app/controllers/projects/compare_controller.rb:56 - [x] :vertical_traffic_light: app/controllers/projects/discussions_controller.rb:29 - [x] :white_check_mark: app/controllers/projects/todos_controller.rb:27 - [x] :vertical_traffic_light: app/models/commit.rb:268 - [x] :white_check_mark: lib/gitlab/search_results.rb:71 - [x] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#d1c10892daedb4d4dd3d4b12b6d071091eea83df_267_266 Memoize ` merged_merge_request(current_user)` - [x] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#d1c10892daedb4d4dd3d4b12b6d071091eea83df_248_247 Expected side effect for `merged_merge_request!`, consider `skip_authorization: true`. - [x] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#d1c10892daedb4d4dd3d4b12b6d071091eea83df_269_269 Scary use of unchecked `merged_merge_request?` See merge request !2033
* | Merge branch '24733-archived-project-merge-request-count' into 'master' Sean McGivern2016-12-062-0/+7
|\ \ | | | | | | | | | | | | | | | | | | Fix Archived project merge requests add to group's Merge Requests Closes #24733 See merge request !7790
| * | Fix Archived project merge requests add to group's Merge RequestsJacopo2016-12-052-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | counter This is done by: - Extending the IssuableFinder adding the non_archived option to the params - Overriding the #filter_params in the MergeRequestsAction - Passing the non_archived param in the nav/_group.html.haml navbar partial from the groups/merge_requests.html.haml
* | | Merge branch 'issue_25064' into 'security' Douwe Maan2016-12-061-5/+8
|/ / | | | | | | | | | | | | | | | | Ensure state param has a valid value when filtering issuables. Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/25064 This fix makes sure we only call safe methods on issuable when filtering by state. See merge request !2038
* | Count all issuable states at onceSean McGivern2016-12-011-0/+26
|/ | | | | | | | | | Instead of doing n queries for n states, do one query to get all the counts grouped by state, and figure out what the count is for each state is from that. We can still cache the individual counts (it can't hurt), but this will help with initial load. Note that the `opened` scope on `Issuable` includes the `opened` and `reopened` states, which is why there's a special case.
* Merge branch 'jej-use-issuable-finder-instead-of-access-check' into 'security' Douwe Maan2016-11-282-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace issue access checks with use of IssuableFinder Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867 ## Which fixes are in this MR? :warning: - Potentially untested :bomb: - No test coverage :traffic_light: - Test coverage of some sort exists (a test failed when error raised) :vertical_traffic_light: - Test coverage of return value (a test failed when nil used) :white_check_mark: - Permissions check tested ### Issue lookup with access check Using `visible_to_user` likely makes these security issues too. See [Code smells](#code-smells). - [x] :vertical_traffic_light: app/finders/notes_finder.rb:15 [`visible_to_user`] - [x] :traffic_light: app/views/layouts/nav/_project.html.haml:73 [`visible_to_user`] [`.count`] - [x] :white_check_mark: app/services/merge_requests/build_service.rb:84 [`issue.try(:confidential?)`] - [x] :white_check_mark: lib/api/issues.rb:112 [`visible_to_user`] - CHANGELOG: Prevented API returning issues set to 'Only team members' to everyone - [x] :white_check_mark: lib/api/helpers.rb:126 [`can?(current_user, :read_issue, issue)`] Maybe here too? - [x] :white_check_mark: lib/gitlab/search_results.rb:53 [`visible_to_user`] ### Previous discussions - [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b2ff264eddf9819d7693c14ae213d941494fe2b3_128_126 - [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#7b6375270d22f880bdcb085e47b519b426a5c6c7_87_87 See merge request !2031
* Merge branch 'jej-fix-missing-access-check-on-issues' into 'security'Douwe Maan2016-11-281-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | Fix missing access checks on issue lookup using IssuableFinder Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867 :warning: - Potentially untested :bomb: - No test coverage :traffic_light: - Test coverage of some sort exists (a test failed when error raised) :vertical_traffic_light: - Test coverage of return value (a test failed when nil used) :white_check_mark: - Permissions check tested - [x] :white_check_mark: app/controllers/projects/branches_controller.rb:39 - `before_action :authorize_push_code!` helpes limit/prevent exploitation. Always checks for reporter access so fine with confidential issues, issues only visible to team, etc. - [x] :traffic_light: app/models/cycle_analytics/summary.rb:9 [`.count`] - [x] :white_check_mark: app/controllers/projects/todos_controller.rb:19 - [x] Potential double render in app/controllers/projects/todos_controller.rb - https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#cedccb227af9bfdf88802767cb58d43c2b977439_24_24 See merge request !2030
* Remove unnecessary require_relative calls from finderSemyon Pupkov2016-11-261-2/+0
|
* Limit labels returned for a specific project as an administratorRobert Speicher2016-11-161-25/+22
| | | | | | | | | Prior, an administrator viewing a project's Labels page would see _all_ labels from every project they had access to, rather than only the labels of that specific project (if any). This was not an information disclosure, as admins have access to everything, but it was a performance issue.
* Merge branch '22481-honour-issue-visibility-for-groups' into 'security' Douwe Maan2016-11-091-19/+14
| | | | | | | | | Honour issue and merge request visibility in their respective finders This MR fixes a security issue with the IssuesFinder and MergeRequestFinder where they would return items the user did not have permission to see. This was most visible on the issue and merge requests page for a group containing projects that had set their issues or merge requests to "private". Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/22481 See merge request !2000
View Lorry Controller Status