| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |\
| |
| |
| |
| |
| |
| | |
'12-3-stable'
Prevent Bypassing Email Verification using Salesforce
See merge request gitlab/gitlabhq!3395
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Fix rubocop offences and add changelog
Add email_verified key for feature specs
Add code review remarks
Add code review remarks
Fix specs
|
| |\ \
| | |
| | |
| | |
| | |
| | |
| | | |
'12-3-stable'
Check that SAML identity linking validates the origin of the request
See merge request gitlab/gitlabhq!3396
|
| | |/
| |
| |
| |
| |
| |
| |
| | |
If the request wasn't initiated by gitlab we shouldn't add the new
identity to the user, and instead show that we weren't able to link
the identity to the user.
This should fix: https://gitlab.com/gitlab-org/gitlab-ce/issues/56509
|
| |\ \
| | |
| | |
| | |
| | |
| | |
| | | |
'security-12717-fix-confidential-issue-assignee-visible-to-guests-12-3' into '12-3-stable'
Display only participants that user has permission to see
See merge request gitlab/gitlabhq!3421
|
| | |/ |
|
| |\ \
| | |
| | |
| | |
| | | |
Redirect user to root path after unsubscribing from private resource
See merge request gitlab/gitlabhq!3423
|
| | |/
| |
| |
| |
| |
| |
| |
| | |
If user unsubsrcribes from a resource that they no longer have
access to they should not be revealed the resource path, but be
redirected to app root instead.
https://gitlab.com/gitlab-org/gitlab-ce/issues/64938
|
| |\ \
| | |
| | |
| | |
| | |
| | |
| | | |
'security-12718-project-milestones-disclosed-via-groups-12-3-ce' into '12-3-stable'
Hide disabled project milestones in project settings on group level
See merge request gitlab/gitlabhq!3424
|
| | |/ |
|
| |/ |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |\
| |
| |
| |
| | |
Enable serving static objects from an external storage
See merge request gitlab-org/gitlab-ce!31025
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
It consists of two parts:
1. Redirecting users to the configured external storage
1. Allowing the external storage to request the static object(s)
on behalf of the user by means of specific tokens
Part of https://gitlab.com/gitlab-com/gl-infra/infrastructure/issues/6829
|
| |\ \
| | |
| | |
| | |
| | |
| | |
| | | |
Optimize /admin/applications so that it does not timeout
Closes #67228
See merge request gitlab-org/gitlab-ce!32852
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
On our dev instance, /admin/applications as not loading because:
1. There was an unindexed query by `application_id`.
2. There was an expensive query that attempted to load 1 million
unique entries via ActiveRecord just to find the unique count.
We fix the first issue by adding an index for that column.
We fix the second issue with a simple SELECT COUNT(DISTINCT
resource_owner_id) SQL query.
In addition, we add pagination to avoid loading more than 20
applications at once.
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/67228
|
| |\ \ \
| | | |
| | | |
| | | |
| | | | |
Optimize queries for snippet listings
See merge request gitlab-org/gitlab-ce!32576
|
| | |/ /
| | |
| | |
| | |
| | |
| | | |
We had similar code in a few places to redirect to the last page if
the given page number is out of range. This unifies the handling in a
new controller concern and adds usage of it in all snippet listings.
|
| |\ \ \
| |/ /
| | |
| | | |
camilstaps/gitlab-ce-new-66023-public-private-fork-counts
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | | |
- Create HAML UI select a cloud provider to create a cluster.
- Add query param to :new cluster view to display a specific cluster
provider form depending on the value of the provider query param.
- Update unit tests and e2e tests to reflect these changes
|
| | | |
| | |
| | |
| | |
| | | |
Utilize `json_fields` to expose fields via
`Service#as_json(only: json_fields)`.
|
| | |\ \
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Fix order-dependent spec failures with reCAPTCHA
Closes #67133
See merge request gitlab-org/gitlab-ce!32771
|
| | | |/
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
spec/controllers/registrations_controller_spec.rb polluted the test
environment by changing the Recaptcha configuration. We now stub the
controller's `verify_recaptcha` method instead of doing that.
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/67133
|
| | |/
| |
| |
| |
| |
| |
| |
| | |
This spec would mess with global state used for captchas, but not reset
the state in all cases. This would then lead to the spec
spec/controllers/snippets_controller_spec.rb failing, but only on a fork
of gitlab-ee. To fix this we ensure the state is properly reset after
running the specs that change this state.
|
| |/ |
|
| |\
| |
| |
| |
| |
| |
| | |
Remove spec/rails_helper.rb
Closes #66741
See merge request gitlab-org/gitlab-ce!32380
|
| | |
| |
| |
| |
| | |
rails_helper.rb's only logic was to require
spec_helper.rb.
|
| | |
| |
| |
| |
| | |
Updates frontend code and specs to allow for the new
feature flag
|
| |\ \ |
|
| | |\ \
| | | |
| | | |
| | | |
| | | | |
Ensure only authorised users can create notes on merge requests and issues
See merge request gitlab/gitlabhq!3137
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
* Prevent creating notes on inaccessible MRs
This applies the notes rules at the MR scope. Rather than adding extra
rules to the Project level policy, preventing :create_note here is
better since it only prevents creating notes on MRs.
* Prevent creating notes in inaccessible Issues
without this policy, non-team-members are allowed to comment on issues
even when the project has the private-issues policy set. This means that
without this change, users are allowed to comment on issues that they
cannot read.
* Add CHANGELOG entry
|
| | |\ \ \
| | | | |
| | | | |
| | | | |
| | | | | |
Add direct upload support for personal snippets
See merge request gitlab/gitlabhq!3226
|
| | | | | | |
|
| | |\ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Fix DNS rebind vulnerability for JIRA integration
See merge request gitlab/gitlabhq!3266
|
| | | | |/ /
| | |/| |
| | | | |
| | | | |
| | | | | |
Uses Gitlab::HTTP for JIRA requests instead of Net::Http.
Gitlab::Http comes with some built in SSRF protections.
|
| | |\ \ \ \
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Require a captcha after unique failed logins from the same IP
See merge request gitlab/gitlabhq!3270
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Add method to store session ids by ip
Add new specs for storing session ids
Add cleaning up records after login
Add retrieving anonymous sessions
Add login recaptcha setting
Add new setting to sessions controller
Add conditions for showing captcha
Add sessions controller specs
Add admin settings specs for login protection
Add new settings to api
Add stub to devise spec
Add new translation key
Add cr remarks
Rename class call
Add cr remarks
Change if-clause for consistency
Add cr remarks
Add code review remarks
Refactor AnonymousSession class
Add changelog entry
Move AnonymousSession class to lib
Move store unauthenticated sessions to sessions controller
Move link to recaptcha info
Regenerate text file
Improve copy on the spam page
Change action filter for storing anonymous sessions
Fix rubocop offences
Add code review remarks
|
| | |\ \ \ \ \
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
Permission fix for MergeRequestsController#pipeline_status
See merge request gitlab/gitlabhq!3274
|
| | | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
- Use set_pipeline_variables to filter for visible pipelines
- Mimic response of nonexistent pipeline if not found
- Provide set_pipeline_variables as a before_filter for other actions
|
