| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
| |
[11.5] Sent notification only to authorized users
See merge request gitlab/gitlabhq!2858
(cherry picked from commit 81c1e9455ca291841704687cdcff085570e89043)
baa1b756 Sent notification only to authorized users
|
| |\
| |
| |
| |
| | |
[11.5] GitLab vulnerable to IDN homograph attacks and RTLO attacks
See merge request gitlab/gitlabhq!2823
|
| | |
| |
| |
| |
| |
| |
| | |
Such as those with IDN homographs or embedded
right-to-left (RTLO) characters.
Autolinked hrefs should be escaped
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
'security-11-5'
[11.5] Do not expose trigger token when user should not see it
See merge request gitlab/gitlabhq!2760
(cherry picked from commit 138126043d62c57b4fb1e057561b433347b36d03)
bd70c84e Do not expose trigger token when user should not see it
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
[11.5] Fix DoS in reference extraction regexes
See merge request gitlab/gitlabhq!2779
(cherry picked from commit 9f3dc81480d4b72a201e3517335c4f18235a1f7d)
0a37ec23 Fix slow project reference pattern regex
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
[11.5] Pipelines section is available to unauthorized users
See merge request gitlab/gitlabhq!2806
(cherry picked from commit 3a060db7ea48eee0f08d06f312b01936abf9cc70)
bd1ae349 Backport security fix
b2469eeb Add CHANGELOG entry
957f6694 Rename Project#all_pipelines to Project#pipelines
8a9894d6 Remove destroy_pipeline specs
|
| |/
|
|
|
|
|
|
|
|
|
| |
'security-11-5'
[11.5] LFS object forgery in project import
See merge request gitlab/gitlabhq!2819
(cherry picked from commit 2bb4e59e6e24aaf25afa3325d9f043709d564129)
ec8e01ab Added validations to prevent LFS object forgery
|
| |\
| |
| |
| |
| |
| |
| | |
'security-11-5'
[11.5] Resolve "Removing a user from a private group doesn't remove them from group's project, if their project's role was changed"
See merge request gitlab/gitlabhq!2715
|
| | |\
| | |
| | |
| | |
| | |
| | | |
'security-fix/security-group-user-removal-11-5'
# Conflicts:
# app/services/members/destroy_service.rb
|
| | | | |
|
| |\ \ \
| |_|/
|/| |
| | | |
into security-11-5
|
| | |/
| |
| |
| | |
Move embeddable? to model to be used outside view
|
| |\ \
| | |
| | |
| | |
| | | |
[11.5] Secret CI variables can exposed by creating a tag with the same name as an existing protected branch
See merge request gitlab/gitlabhq!2682
|
| | | | |
|
| |\ \ \
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
'security-11-5'
[11.5] Ensure that build token is only used when running
See merge request gitlab/gitlabhq!2664
|
| | |/ /
| | |
| | |
| | |
| | | |
1. We provide an updated interface to ensure that,
2. We authenticate build dependendencies by build that is being run,
|
| |\ \ \
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
'security-11-5'
[11.5] SSRF - Scan Internal Ports and GCP/AWS endpoints
See merge request gitlab/gitlabhq!2709
|
| | | |/
| |/|
| | |
| | | |
mirror urls
|
| |/ /
| |
| |
| |
| | |
Fix leaking information of confidential issues on TODOs
when user is downgraded to guest access.
|
| |/
|
|
|
|
|
|
| |
Remove Site Statistic
Closes #53778
See merge request gitlab-org/gitlab-ce!23314
|
| |
|
|
| |
confidential issues
|
| |\
| |
| |
| |
| |
| |
| | |
'security-11-5-xss-in-markdown-following-unrecognized-html-element' into 'security-11-5'
[11.5] XSS in markdown following unrecognized HTML element
See merge request gitlab/gitlabhq!2631
|
| | | |
|
| |\ \
| |/
|/|
| |
| | |
[11.5] Do not follow redirects in prometheus service
See merge request gitlab/gitlabhq!2623
|
| | |
| |
| |
| | |
Do not allow redirects in the prometheus service to prevent SSRFs.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Ignore environment validation failure
See merge request gitlab-org/gitlab-ce!23100
(cherry picked from commit 0f25d2b33fbee7161f0ecf26a6d853533808beec)
ea695ab7 Ignore environment validation failure
a2a2a8f0 Add changelog
00842f95 User persisted?
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Avoid returning deployment metrics url to MR widget when the deployment is not successful
Closes #53870
See merge request gitlab-org/gitlab-ce!23010
(cherry picked from commit 7674a8f477c90c1c8c9a969e7d80ea1ec9e72cd9)
e270fcc8 Fix deployment metrics in MR widget
15431054 Add spec for deployment metrics
2d6570f0 Do not remove the existing permission check
09e693c6 Add changelog
d8c24ac1 Remove unrelated changes
|
| | |
| |
| |
| |
| |
| |
| | |
Comment on any expanded diff line on MRs (with feature-flag)
Closes #13950
See merge request gitlab-org/gitlab-ce!22914
|
| | |
| |
| |
| |
| |
| |
| | |
Fix a race condition in the shard population logic
Closes #53972
See merge request gitlab-org/gitlab-ce!23028
|
| | |
| |
| |
| |
| |
| |
| | |
Fix deployment jobs using nil token
Closes #53879
See merge request gitlab-org/gitlab-ce!23009
|
| | |
| |
| |
| |
| |
| |
| | |
Fix tags for environments
Closes gitlab-ee#8397
See merge request gitlab-org/gitlab-ce!22993
|
| | |
| |
| |
| |
| |
| |
| | |
Fix MergeRequestService erroring out on deleted branch
Closes #53853
See merge request gitlab-org/gitlab-ce!22989
|
| | |
| |
| |
| |
| | |
Revert "Extract code into IssueBoardEntity"
See merge request gitlab-org/gitlab-ce!22928
|
| | |
| |
| |
| |
| | |
Revert "Merge branch 'osw-comment-on-any-line-on-diffs' into 'master'"
See merge request gitlab-org/gitlab-ce!22891
|
| |\ \
| | |
| | |
| | |
| | | |
StuckImportJobsWorker query performance optimization
See merge request gitlab-org/gitlab-ce!22879
|
| | | |
| | |
| | |
| | |
| | |
| | | |
Improves the performance of fetching the enqueued
projects for StuckImportJobsWorker, preventing a
statement timeout.
|
| |\ \ \
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Add endpoint to update a git submodule reference
Closes #41213
See merge request gitlab-org/gitlab-ce!20949
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
This new endpoint allow users to update a submodule's reference.
The MR involves adding a new operation RPC operation in gitaly-proto
(see gitlab-org/gitaly-proto!233) and change Gitaly to use this
new version (see gitlab-org/gitaly!936).
See gitlab-org/gitlab-ce!20949
|
| |\ \ \ \
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Allow to configure when to retry builds
Closes gitlab-runner#3515
See merge request gitlab-org/gitlab-ce!21758
|
| | | | | | |
|
| | | | | | |
|
| | | | | | |
|
| | | | | | |
|
| | | | | | |
|
| | | | | | |
|
| | | | | | |
|
| | | | | | |
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
- when it is a hash, retries max count is assumed to be at hash[:max]
- when it is an integer, this is the max count (as before)
|
| |\ \ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Allow to install Knative as cluster application
See merge request gitlab-org/gitlab-ce!22593
|
| | | | | | | |
|
