summaryrefslogtreecommitdiff
path: root/app
Commit message (Expand)AuthorAgeFilesLines
* Return NO_ACCESS if user is nilPatrick Derichs2019-08-281-0/+2
* Merge branch 'security-hide_merge_request_ids_on_emails-12-0' into '12-0-stable'GitLab Release Tools Bot2019-08-262-0/+6
|\
| * Prevent disclosure of merge request id via emailFelipe Artur2019-08-212-0/+6
* | Merge branch 'security-64711-fix-commit-todos-12-0' into '12-0-stable'GitLab Release Tools Bot2019-08-261-4/+2
|\ \
| * | Send TODOs for comments on commits correctlyNick Thomas2019-08-231-4/+2
| |/
* | Add captcha if there are multiple failed login attemptsMałgorzata Ksionek2019-08-267-7/+61
* | Merge branch 'security-12-0-enable-image-proxy' into '12-0-stable'GitLab Release Tools Bot2019-08-264-15/+60
|\ \
| * | Add support for using a Camo proxy serverBrett Walker2019-08-154-15/+60
| |/
* | Merge branch 'security-60551-fix-upload-scope-12-0' into '12-0-stable'GitLab Release Tools Bot2019-08-262-2/+2
|\ \
| * | Queries for Upload should be scoped by modelAdam Hegyi2019-07-112-2/+2
* | | Merge branch 'security-epic-notes-api-reveals-historical-info-ce-12-0' into '...GitLab Release Tools Bot2019-08-263-2/+6
|\ \ \
| * | | Filter out old system notes for epicsPatrick Derichs2019-08-093-2/+6
| | |/ | |/|
* | | Merge branch 'security-fix-html-injection-for-label-description-ce-12-0' into...GitLab Release Tools Bot2019-08-262-3/+7
|\ \ \
| * | | Fix HTML injection for label descriptionPatrick Derichs2019-08-062-3/+7
| |/ /
* | | Merge branch 'security-61974-limit-issue-comment-size-12-0' into '12-0-stable'GitLab Release Tools Bot2019-08-262-0/+2
|\ \ \
| * | | Limit the size of issuable description and commentsAlexandru Croitor2019-08-222-0/+2
| |/ /
* | | Merge branch 'security-mr-head-pipeline-leak-12-0' into '12-0-stable'GitLab Release Tools Bot2019-08-261-1/+8
|\ \ \
| * | | Permission fix for MergeRequestsController#pipeline_statusdrew cimino2019-08-121-1/+8
| |/ /
* | | Merge branch 'security-katex-dos-12-0' into '12-0-stable'GitLab Release Tools Bot2019-08-261-18/+128
|\ \ \
| * | | Enforce max chars and max render time in markdown mathMartin Hanzel2019-08-061-18/+128
| |/ /
* | | Merge branch 'security-2853-prevent-comments-on-private-mrs-12-0' into '12-0-...GitLab Release Tools Bot2019-08-262-4/+11
|\ \ \
| * | | Prevent unauthorised comments on merge requestsAlex Kalderimis2019-08-072-4/+11
| |/ /
* | | Merge branch 'security-fix_jira_ssrf_vulnerability-12-0' into '12-0-stable'GitLab Release Tools Bot2019-08-261-1/+6
|\ \ \
| * | | Fix DNS rebind vulnerability for JIRA integrationFelipe Artur2019-08-081-1/+6
| |/ /
* | | Merge branch 'security-id-filter-timeline-activities-for-guests-12-0' into '1...GitLab Release Tools Bot2019-08-261-1/+1
|\ \ \
| * | | Add merge note type as cross referenceIgor Drozdov2019-08-211-1/+1
| |/ /
* | | Merge branch 'security-project-import-bypass-12-0' into '12-0-stable'GitLab Release Tools Bot2019-08-261-11/+16
|\ \ \
| * | | Fix project import restricted visibility bypassGeorge Koltsov2019-08-151-11/+16
| |/ /
* | | Merge branch 'security-add-job-activity-limit-ce-12-0' into '12-0-stable'GitLab Release Tools Bot2019-08-262-1/+3
|\ \ \
| * | | Add active_jobs_limit to plans tableFabio Pitino2019-08-212-1/+3
| |/ /
* | | Merge branch 'security-sarcila-fix-weak-session-management-12-0' into '12-0-s...GitLab Release Tools Bot2019-08-261-0/+7
|\ \ \
| * | | Add User#will_save_change_to_login? to clear reset_password_tokensSebastian Arcila Valenzuela2019-08-211-0/+7
| |/ /
* | | Merge branch 'security-ci-metrics-permissions-12-0' into '12-0-stable'GitLab Release Tools Bot2019-08-261-0/+6
|\ \ \
| * | | Restrict MergeRequests#test_reports to authenticated users with read-access o...drew cimino2019-08-221-0/+6
| |/ /
* | | Merge branch 'security-personal-snippets-12-0' into '12-0-stable'GitLab Release Tools Bot2019-08-263-2/+12
|\ \ \
| * | | Add direct upload support for personal snippetsJan Provaznik2019-08-233-2/+12
| |/ /
* | | admin_group authorization for Groups::RunnersControllerdrew cimino2019-08-221-5/+1
|/ /
* | Merge branch 'security-fix-badges-leaked-to-unauthorized-users-12-0' into '12...GitLab Release Tools Bot2019-07-241-1/+2
|\ \
| * | Don't display badges when builds are restrictedFabio Pitino2019-06-271-1/+2
* | | Merge branch 'security-mr-pipeline-permissions-12-0' into '12-0-stable'GitLab Release Tools Bot2019-07-242-2/+3
|\ \ \
| * | | Use MergeRequest#source_project as permissions reference for MergeRequest#all...drew cimino2019-07-052-2/+3
| | |/ | |/|
* | | Merge branch 'security-remove-take-trigger-ownership-feature-12-0' into '12-0...GitLab Release Tools Bot2019-07-242-14/+1
|\ \ \
| * | | Drop feature to take ownership of a trigger tokenFabio Pitino2019-07-172-14/+1
| |/ /
* | | Merge branch 'security-2873-restrict-slash-commands-to-users-who-can-log-in-1...GitLab Release Tools Bot2019-07-242-0/+5
|\ \ \
| * | | Restrict slash commands to users who can log inHordur Freyr Yngvason2019-07-122-0/+5
| |/ /
* | | Merge branch 'security-bvl-filter-mr-params-12-0' into '12-0-stable'GitLab Release Tools Bot2019-07-241-6/+22
|\ \ \
| * | | Filter params in MR build serviceBob Van Landuyt2019-07-171-6/+22
| |/ /
* | | Do not show moved issue ids for user not authorizedFelipe Artur2019-07-151-1/+6
|/ /
* | Support object storage at FileMover classOswaldo Ferreira2019-06-301-18/+43
|/
* Merge branch 'security-notes-in-private-snippets-12-0' into '12-0-stable'GitLab Release Tools Bot2019-06-262-9/+13
|\
View Lorry Controller Status