| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |\
| |
| |
| |
| | |
Reduce diff with EE in Groups::CreateService
See merge request gitlab-org/gitlab-ce!24871
|
| | |
| |
| |
| | |
Signed-off-by: Rémy Coutable <remy@rymai.me>
|
| |\ \
| | |
| | |
| | |
| | | |
Fix migration when project repository is missing
See merge request gitlab-org/gitlab-ce!24859
|
| | | |
| | |
| | |
| | |
| | | |
The data migration looks for code owner file and errs
if repository is missing.
|
| |\ \ \
| |_|/
|/| |
| | |
| | | |
Reduce diff with EE in Ci::PipelineTriggerService
See merge request gitlab-org/gitlab-ce!24866
|
| | |/
| |
| |
| | |
Signed-off-by: Rémy Coutable <remy@rymai.me>
|
| |/ |
|
| | |
|
| |\
| |
| |
| |
| | |
Add CSS helper classes for positioning
See merge request gitlab-org/gitlab-ce!24821
|
| | | |
|
| |\ \
| | |
| | |
| | |
| | | |
Add e2e QA test for logging in using Github OAuth
See merge request gitlab-org/gitlab-ce!24817
|
| | | |
| | |
| | |
| | |
| | | |
Adds the test itself and the vendor page object model for GitHub
login pages.
|
| |/ / |
|
| | | |
|
| |\ \
| | |
| | |
| | |
| | |
| | |
| | | |
Fix flaky wiki create test
Closes gitlab-org/quality/nightly#24
See merge request gitlab-org/gitlab-ce!24778
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
There's an svg on the page that allows you to create a wiki page.
The svg takes a fraction of a second to load after which the
"Create your first page" button shifts up a bit. This can cause
webdriver to miss the hit so we wait for the svg to load before
clicking the button.
Also update the elements used in the test to conform to our best
practice.
And replace `act` with `perform`
Finally, remove the `before` block and `login` method, making the
code slightly simpler.
|
| | | | |
|
| | | | |
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | | |
When a user is a guest user, and the "Public Pipeline" is set to false
inside of "Settings > CI/CD > General" the commit status in the project
dashboard should not be shown.
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
When moving a project, it's possible that some users who had
access to the project in old path can not access the project
in the new path.
Because `project_authorizations` records are updated asynchronously,
when we send the notification about moved project the list of project
team members contains old project members, we want to notify all these
members except the old users who can not access the new location.
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
To prevent an OAuth2 covert redirect vulnerability, this commit adds and
uses an alias for the GitHub and BitBucket OAuth2 callback URLs to the
following paths:
GitHub: /users/auth/-/import/github
Bitbucket: /users/auth/-/import/bitbucket
This allows admins to put a more restrictive callback URL in the OAuth2
configuration settings. Instead of https://example.com, admins can now use:
https://example.com/users/auth
It's possible but not trivial to change Devise and OmniAuth to use a
different prefix for callback URLs instead of /users/auth. For now,
aliasing the import URLs under the /users/auth namespace should suffice.
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/56663
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
LFS uploads are handled in concert by workhorse and rails. In normal
use, workhorse:
* Authorizes the request with rails (upload_authorize)
* Handles the upload of the file to a tempfile - disk or object storage
* Validates the file size and contents
* Hands off to rails to complete the upload (upload_finalize)
In `upload_finalize`, the LFS object is linked to the project. As LFS
objects are deduplicated across all projects, it may already exist. If
not, the temporary file is copied to the correct place, and will be
used by all future LFS objects with the same OID.
Workhorse uses the Content-Type of the request to decide to follow this
routine, as the URLs are ambiguous. If the Content-Type is anything but
"application/octet-stream", the request is proxied directly to rails,
on the assumption that this is a normal file edit request. If it's an
actual LFS request with a different content-type, however, it is routed
to the Rails `upload_finalize` action, which treats it as an LFS upload
just as it would a workhorse-modified request.
The outcome is that users can upload LFS objects that don't match the
declared size or OID. They can also create links to LFS objects they
don't really own, allowing them to read the contents of files if they
know just the size or OID.
We can close this hole by requiring requests to `upload_finalize` to be
sourced from Workhorse. The mechanism to do this already exists.
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
RubyZip allows us to perform strong validation of
expanded paths where we do extract file.
We introduce the following additional checks
to extract routines:
1. None of path components can be symlinked,
2. We drop privileges support for directories,
3. Symlink source needs to point within the target directory,
like `public/`,
4. The symlink source needs to exist ahead of time.
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This changes the permission check so it uses the policy on Noteable
instead of Project. This prevents bypassing of rules defined in
Noteable for locked discussions and confidential issues.
Also rechecks permissions when reply_to_discussion_id is provided since the
discussion_id may be from a different noteable.
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Since we needed to bump the version to 13 in the backports,
and we know that an MR on master also bumped it
to 13, bump to 14 to ensure that when a customer
upgrades to the most recent release, the markdown
gets recalcuated as necessary.
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | | |
Group guests will only be displayed merge requests to
projects they have a access level to, higher than Reporter.
Visible projects will still display the merge requests to Guests
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
When the external wiki is enabled, the internal wiki link is replaced
by the external wiki url. But the internal wiki is still accessible.
In this change the external wiki will have its own tab in the sidebar
and only if the services are disabled the tab (and access rights)
will not be displayed.
|
| | | | |
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | | |
When the parent noteable is not visible to the user (e.g. confidential)
we prevent the user from adding emoji reactions to notes
|
| | | |
| | |
| | |
| | | |
Removes special error message when creating new issues
|
| | | | |
|
| | | | |
|
| | | | |
|
| | | | |
|
| |\ \ \
| | | |
| | | |
| | | |
| | | | |
Support for ignore rules in 'convertObjectPropsToCamelCase' helper
See merge request gitlab-org/gitlab-ce!24790
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Does following enhancements to `convertObjectPropsToCamelCase` helper;
- Adds support for `dropKeys` within options param
to discard properties.
- Adds support for `allowKeys` within options param
to skip converting property names.
|
| | | | | |
|
| |\ \ \ \
| |/ / /
|/| | |
| | | |
| | | |
| | | |
| | | | |
Append prioritized label before pagination
Closes #24875
See merge request gitlab-org/gitlab-ce!24815
|
| | | | | |
|
| | | | | |
|
| |\ \ \ \
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Update runner admin page to make description field larger
Closes #54639
See merge request gitlab-org/gitlab-ce!23593
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
This changes the table with for the desciption and version fields to make the runner descriptions more readable.
added changelog
|
| |\ \ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Reduce Bundle Size by making select2 loading optional
Closes #56988
See merge request gitlab-org/gitlab-ce!24727
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Wraps all imports for select 2 to deferred imports,
especially in the main.js we are actually checking if there
is any select 2 element on the page or not.
|
