summaryrefslogtreecommitdiff
path: root/app
Commit message (Expand)AuthorAgeFilesLines
* Merge branch 'security-11-4' of dev.gitlab.org:gitlab/gitlabhq into 11-4-stableJohn Jarvis2018-12-2711-15/+78
|\
| * Merge branch 'security-fix/security-group-user-removal-11-4' into 'security-1...John Jarvis2018-12-276-4/+56
| |\
| | * Merge branch 'security-11-4' into 'security-fix/security-group-user-removal-1...James Lopez2018-12-2724-60/+168
| | |\
| | * | Add subresources removal to member destroy serviceJames Lopez2018-12-136-6/+52
| * | | Merge remote-tracking branch 'origin/security-48259-private-snippet-11-4' int...John Jarvis2018-12-275-11/+22
| |\ \ \ | | |_|/ | |/| |
| | * | Block private snippets from being embeddableMark Chao2018-12-205-11/+22
| | |/
* | | Merge branch 'security-11-4' of dev.gitlab.org:gitlab/gitlabhq into 11-4-stableJohn Jarvis2018-12-271-3/+3
|\ \ \ | |/ /
| * | Merge branch 'security-11-4-group-cicd-settings-accessible-to-maintainer' int...John Jarvis2018-12-271-3/+3
| |\ \
| | * | Check for group admin permissionsMatija Čupić2018-12-241-3/+3
| | |/
* | | Merge branch 'security-11-4' of dev.gitlab.org:gitlab/gitlabhq into 11-4-stableJohn Jarvis2018-12-2724-64/+166
|\ \ \ | |/ /
| * | Merge branch 'security-11-4-secret-ci-variables-exposed' into 'security-11-4'John Jarvis2018-12-275-11/+50
| |\ \
| | * | Backport security fix for 11.4Matija Čupić2018-12-085-11/+50
| * | | Merge branch 'security-11-4-53543-user-keeps-access-to-mr-issue-when-removed-...John Jarvis2018-12-271-1/+1
| |\ \ \
| | * | | Adds validation to check if user can read projectTiago Botelho2018-12-191-1/+1
| | | |/ | | |/|
| * | | Merge branch 'security-11-4-refs-available-to-project-guest' into 'security-1...John Jarvis2018-12-271-0/+1
| |\ \ \
| | * | | Project guests no longer are able to see refs pageTiago Botelho2018-12-191-0/+1
| | |/ /
| * | | Merge branch 'security-11-4-fix-ssrf-lfs-project-import' into 'security-11-4'John Jarvis2018-12-271-8/+27
| |\ \ \
| | * | | Fixed SSRF in project imports with LFSFrancisco Javier López2018-12-181-8/+27
| | |/ /
| * | | [11.4] Stored XSS in latest IEFrancisco Javier López2018-12-276-15/+26
| * | | Merge branch 'ensure-that-build-token-is-always-running-11-4' into 'security-...John Jarvis2018-12-271-0/+4
| |\ \ \
| | * | | Ensure that build token is only used when runningKamil Trzciński2018-12-181-0/+4
| | | |/ | | |/|
| * | | [11.4] SSRF - Scan Internal Ports and GCP/AWS endpointsFrancisco Javier López2018-12-272-5/+5
| * | | Merge branch 'security-11-4-54377-label-milestone-name-xss' into 'security-11-4'John Jarvis2018-12-261-6/+10
| |\ \ \
| | * | | Escape label and milestone titles to prevent XSSKushal Pandya2018-12-201-6/+10
| | | |/ | | |/|
| * | | Merge branch 'security-todos_not_redacted_for_guests-11-4' into 'security-11-4'John Jarvis2018-12-267-11/+25
| |\ \ \
| | * | | Delete confidential issue todos for guestsFelipe Artur2018-12-177-11/+25
| | |/ /
| * | | Validate projects in MR build serviceBob Van Landuyt2018-12-141-7/+17
| |/ /
| * | Validate LFS hrefs before downloading themNick Thomas2018-12-121-0/+3
| |/
* | Merge branch 'security-2754-fix-lfs-import-11-4' into 'security-11-4'John Jarvis2018-12-131-0/+3
* | Merge branch 'if-53347_fix_impersonation_tokens' into 'master'Stan Hu2018-11-305-17/+23
|/
* Merge branch 'security-fix-uri-xss-applications-11-4' into 'security-11-4'Steve Azzopardi2018-11-261-1/+1
|\
| * Resolve reflected XSS in Ouath authorize windowJames Lopez2018-11-261-1/+1
* | Merge branch 'security-email-change-notification-11-4' into 'security-11-4'Steve Azzopardi2018-11-262-0/+22
|\ \ | |/ |/|
| * Provide email notification on email updatesJames Lopez2018-11-122-0/+22
* | [11.4] Fixed ability to comment on and edit/delete comments on locked or conf...Chantal Rollison2018-11-267-2/+23
* | Merge branch 'security-fix-pat-web-access-11-4' into 'security-11-4'Steve Azzopardi2018-11-2611-26/+52
|\ \
| * | Update code to use API scope on PAT authJames Lopez2018-11-2311-26/+52
* | | Merge branch 'security-11-4-xss-in-markdown-following-unrecognized-html-eleme...Steve Azzopardi2018-11-231-1/+1
|\ \ \
| * | | Sanitize output of SpacedLinkFilterBrett Walker2018-11-161-1/+1
* | | | Merge branch 'security-mermaid-xss-11-4' into 'security-11-4'Steve Azzopardi2018-11-231-0/+3
|\ \ \ \
| * | | | Configure mermaid to not render HTML content in diagramsWinnie Hellmann2018-11-141-0/+3
| |/ / /
* | | | Merge branch 'security-bvl-exposure-in-commits-list-11-4' into 'security-11-4'Steve Azzopardi2018-11-231-53/+41
|\ \ \ \
| * | | | Don't use fragment cache on commit pageBob Van Landuyt2018-11-191-53/+41
| | |/ / | |/| |
* | | | Merge branch 'security-issue_51301-11-4' into 'security-11-4'Steve Azzopardi2018-11-233-6/+32
|\ \ \ \
| * | | | Fix milestone promotion authorizationFelipe Artur2018-11-143-6/+32
| | |_|/ | |/| |
* | | | Merge branch 'security-2736-prometheus-ssrf-11-4' into 'security-11-4'Steve Azzopardi2018-11-231-1/+1
|\ \ \ \
| * | | | No redirects in prometheus servicerpereira22018-11-141-1/+1
| | |_|/ | |/| |
* | | | Merge branch 'security-private-group-11-4' into 'security-11-4'Steve Azzopardi2018-11-231-0/+10
|\ \ \ \ | |_|_|/ |/| | |
| * | | Fixed read name of private groupsChantal Rollison2018-11-071-0/+10
| | |/ | |/|
* | | Merge branch 'security-11-4-2717-xss-username-autocomplete' into 'security-11-4'Steve Azzopardi2018-11-181-4/+11
|\ \ \ | |_|/ |/| |
View Lorry Controller Status