summaryrefslogtreecommitdiff
path: root/app
Commit message (Expand)AuthorAgeFilesLines
* Merge branch 'security-fix/security-group-user-removal-11-5' into 'security-1...John Jarvis2018-12-276-4/+56
|\
| * Merge branch 'security-11-5' into 'security-fix/security-group-user-removal-1...James Lopez2018-12-2718-56/+141
| |\
| * | Add subresources removal to member destroy serviceJames Lopez2018-12-136-6/+52
* | | Merge remote-tracking branch 'origin/security-48259-private-snippet-11-5' int...John Jarvis2018-12-275-11/+22
|\ \ \ | |_|/ |/| |
| * | Block private snippets from being embeddableMark Chao2018-12-205-11/+22
| |/
* | Merge branch 'security-11-5-secret-ci-variables-exposed' into 'security-11-5'John Jarvis2018-12-275-21/+50
|\ \
| * | Backport security fix for 11.5Matija Čupić2018-12-085-21/+50
* | | Merge branch 'security-11-5-53543-user-keeps-access-to-mr-issue-when-removed-...John Jarvis2018-12-271-1/+1
|\ \ \
| * | | Adds validation to check if user can read projectTiago Botelho2018-12-191-1/+1
| | |/ | |/|
* | | Merge branch 'security-11-5-group-cicd-settings-accessible-to-maintainer' int...John Jarvis2018-12-271-3/+3
|\ \ \
| * | | Check for group admin permissionsMatija Čupić2018-12-241-3/+3
| |/ /
* | | Merge branch 'security-11-5-refs-available-to-project-guest' into 'security-1...John Jarvis2018-12-271-0/+1
|\ \ \
| * | | Project guests no longer are able to see refs pageTiago Botelho2018-12-191-0/+1
| |/ /
* | | Merge branch 'security-11-5-fix-ssrf-lfs-project-import' into 'security-11-5'John Jarvis2018-12-271-8/+27
|\ \ \
| * | | Fixed SSRF in project imports with LFSFrancisco Javier López2018-12-181-8/+27
| |/ /
* | | Merge branch 'ensure-that-build-token-is-always-running-11-5' into 'security-...John Jarvis2018-12-271-0/+4
|\ \ \
| * | | Ensure that build token is only used when runningKamil Trzciński2018-12-181-0/+4
| | |/ | |/|
* | | Merge branch 'security-11-5-fix-ssrf-import-url-remote-mirror' into 'security...John Jarvis2018-12-272-5/+4
|\ \ \
| * | | Replaced UrlValidator with PublicUrlValidator for import_url and remote mirro...Francisco Javier López2018-12-132-5/+4
| | |/ | |/|
* | | Merge branch 'security-11-5-54377-label-milestone-name-xss' into 'security-11-5'John Jarvis2018-12-261-7/+10
|\ \ \
| * | | Escape label and milestone titles to prevent XSSKushal Pandya2018-12-201-7/+10
| |/ /
* | | Merge branch 'security-todos_not_redacted_for_guests-11-5' into 'security-11-5'John Jarvis2018-12-267-11/+25
|\ \ \
| * | | Delete confidential issue todos for guestsFelipe Artur2018-12-177-11/+25
| |/ /
* | | Validate projects in MR build serviceBob Van Landuyt2018-12-141-7/+17
|/ /
* | Validate LFS hrefs before downloading themNick Thomas2018-12-121-0/+3
* | Merge branch '53778-remove-site-statistics' into 'master'Sean McGivern2018-11-302-79/+0
* | Fixed GitLab UI importPhil Hughes2018-11-302-2/+5
* | Merge branch '_acet-fix-unable-to-reply-resolved-nondiff-discussion' into 'ma...Phil Hughes2018-11-302-6/+12
* | Merge branch '54282-tooltip-stuck' into 'master'Phil Hughes2018-11-301-4/+4
* | Merge branch 'sh-fix-hash-filename-handling' into 'master'Douglas Barbosa Alexandre2018-11-301-2/+2
* | Merge branch 'image-diff-size-fix' into 'master'Filipa Lacerda2018-11-304-35/+12
* | Merge branch 'fix-not-render-emoji' into 'master'Mike Greiling2018-11-301-4/+7
* | Merge branch 'if-53347_fix_impersonation_tokens' into 'master'Stan Hu2018-11-305-17/+23
|/
* Merge branch 'security-fix-uri-xss-applications-11-5' into 'security-11-5'Steve Azzopardi2018-11-261-1/+1
|\
| * Resolve reflected XSS in Ouath authorize windowJames Lopez2018-11-261-1/+1
* | Merge branch 'security-email-change-notification-11-5' into 'security-11-5'Steve Azzopardi2018-11-262-0/+22
|\ \
| * | Provide email notification on email updatesJames Lopez2018-11-122-0/+22
* | | [11.5] Fixed ability to comment on and edit/delete comments on locked or conf...Chantal Rollison2018-11-267-2/+23
| |/ |/|
* | Update code to use API scope on PAT authJames Lopez2018-11-2311-30/+52
* | Merge branch 'security-11-5-xss-in-markdown-following-unrecognized-html-eleme...Steve Azzopardi2018-11-231-1/+1
|\ \
| * | Sanitize output of SpacedLinkFilterBrett Walker2018-11-161-1/+1
* | | Merge branch 'security-mermaid-xss-11-5' into 'security-11-5'Steve Azzopardi2018-11-231-0/+3
|\ \ \
| * | | Configure mermaid to not render HTML content in diagramsWinnie Hellmann2018-11-191-0/+3
* | | | Merge branch 'security-bvl-exposure-in-commits-list-11-5' into 'security-11-5'Steve Azzopardi2018-11-231-53/+41
|\ \ \ \
| * | | | Don't use fragment cache on commit pageBob Van Landuyt2018-11-191-53/+41
| |/ / /
| * | | Merge branch 'security-11-5-2717-xss-username-autocomplete' into 'security-11-5'Steve Azzopardi2018-11-181-4/+11
| |\ \ \ | | |/ / | |/| |
| | * | Fix user name autocomplete XSS when name contains HTMLKushal Pandya2018-11-121-4/+11
| | |/
* | | Merge branch 'security-issue_51301-11-5' into 'security-11-5'Steve Azzopardi2018-11-233-6/+32
|\ \ \
| * | | Fix milestone promotion authorizationFelipe Artur2018-11-143-6/+32
| | |/ | |/|
* | | Merge branch 'security-2736-prometheus-ssrf-11-5' into 'security-11-5'Steve Azzopardi2018-11-231-1/+1
|\ \ \
View Lorry Controller Status