delta/gitlab/gitlab-ce.git - gitlab.com: gitlab-org/gitlab-ce.git

	Commit message (Collapse)	Author	Age	Files	Lines
*	Ignore Puma empty worker stats	Jan Provaznik	2019-06-04	1	-0/+27
\| \| \| \| \| \| \|	In some cases (during worker start) it's possible that Puma.stats returns an empty hash for worker's last status. In that case we just skip sampling of the worker until these stats are available.
*	Merge branch 'master' of dev.gitlab.org:gitlab/gitlabhq	Robert Speicher	2019-06-03	4	-1/+71
\|\
\| *	Merge branch 'security-60143-address-xss-issue-master' into 'master'	Robert Speicher	2019-06-03	1	-0/+42
\| \|\ \| \| \| \| \| \| \| \| \| \| \| \|	Reject slug+uri concat if slug is deemed unsafe See merge request gitlab/gitlabhq!3108
\| \| *	Reject slug+uri concat if slug is deemed unsafe	Kerri Miller	2019-05-24	1	-0/+42
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	First reported: https://gitlab.com/gitlab-org/gitlab-ce/issues/60143 When the page slug is "javascript:" and we attempt to link to a relative path (using `.` or `..`) the code will concatenate the slug and the uri. This MR adds a guard to that concat step that will return `nil` if the incoming slug matches against any of the "unsafe" slug regexes; currently this is only for the slug "javascript:" but can be extended if needed. Manually tested against a non-exhaustive list from OWASP of common javascript XSS exploits that have to to with mangling the "javascript:" method, and all are caught by this change or by existing code that ingests the user-specified slug.
\| * \|	Merge branch 'security-58856-persistent-xss-in-note-objects' into 'master'	Robert Speicher	2019-06-03	3	-1/+29
\| \|\ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Persistent XSS in note objects CE See merge request gitlab/gitlabhq!3075
\| \| * \|	Remove unused fixture lines	Tiger	2019-05-28	1	-2/+0
\| \| \| \|
\| \| * \|	Add `html` to sensitive words	charlieablett	2019-05-01	1	-1/+2
\| \| \| \|
\| \| * \|	Remove accidental regressions	charlieablett	2019-04-30	1	-5/+6
\| \| \| \|
\| \| * \|	Ensure Issue & MR note_html cannot be imported	Ash McKenzie	2019-04-30	2	-16/+16
\| \| \| \|
\| \| * \|	Add disallowed fields to AttributeCleaner	charlieablett	2019-04-24	2	-10/+8
\| \| \| \|
\| \| * \|	Re-stub stubbed method calls	charlieablett	2019-04-23	1	-3/+9
\| \| \| \|
\| \| * \|	Exclude fields from note import	charlieablett	2019-04-23	2	-2/+26
\| \| \| \|
* \| \| \|	Merge dev.gitlab.org master into GitLab.com master	Yorick Peterse	2019-06-03	16	-64/+438
\|\ \ \ \ \| \|/ / /
\| * \| \|	Merge branch 'security-fix_milestones_search_api_leak' into 'master'	GitLab Release Tools Bot	2019-06-03	1	-0/+24
\| \|\ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Resolve: Milestones leaked via search API Closes #2822 See merge request gitlab/gitlabhq!2997
\| \| * \| \|	Resolve: Milestones leaked via search API	Felipe Artur	2019-05-20	1	-0/+24
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Fix milestone titles being leaked using search API when users cannot read milestones
\| * \| \| \|	Merge branch 'security-60039' into 'master'	GitLab Release Tools Bot	2019-06-03	2	-27/+66
\| \|\ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Disallow invalid MR branch name See merge request gitlab/gitlabhq!3052
\| \| * \| \| \|	Refactor spec to not use truthy or falsey	Mark Chao	2019-05-03	1	-58/+58
\| \| \| \| \| \|
\| \| * \| \| \|	Validate MR branch names	Mark Chao	2019-05-03	2	-27/+66
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Prevents refspec as branch name, which would bypass branch protection when used in conjunction with rebase. HEAD seems to be a special case with lots of occurrence, so it is considered valid for now. Another special case is `refs/head/*`, which can be imported.
\| * \| \| \| \|	Merge branch 'security-id-leaked-password-in-import-url-frontend' into 'master'	GitLab Release Tools Bot	2019-06-03	1	-0/+34
\| \|\ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Handling password on import by url page See merge request gitlab/gitlabhq!3061
\| \| * \| \| \| \|	Hide password on import by url form	Igor Drozdov	2019-05-29	1	-0/+34
\| \| \| \|_\|_\|/ \| \| \|/\| \| \|
\| * \| \| \| \|	Merge branch 'dm-http-hostname-override' into 'master'	GitLab Release Tools Bot	2019-06-03	11	-23/+296
\| \|\ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Protect Gitlab::HTTP against DNS rebinding attack See merge request gitlab/gitlabhq!3071
\| \| * \| \| \| \|	Add DNS rebinding protection settings	Oswaldo Ferreira	2019-05-30	3	-0/+97
\| \| \| \| \| \| \|
\| \| * \| \| \| \|	Protect Gitlab::HTTP against DNS rebinding attack	Douwe Maan	2019-05-30	10	-23/+199
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Gitlab::HTTP now resolves the hostname only once, verifies the IP is not blocked, and then uses the same IP to perform the actual request, while passing the original hostname in the `Host` header and SSL SNI field.
\| * \| \| \| \| \|	Merge branch 'security-fix-project-existence-disclosure-master' into 'master'	GitLab Release Tools Bot	2019-06-03	1	-14/+18
\| \|\ \ \ \ \ \ \| \| \|/ / / / / \| \|/\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Fix url redaction for issue links See merge request gitlab/gitlabhq!3091
\| \| * \| \| \| \|	Fix url redaction for issue links	Patrick Derichs	2019-05-03	1	-14/+18
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Add changelog entry Add missing href to all redactor specs and removed href assignment Remove obsolete spec If original_content is given, it should be used for link content
* \| \| \| \| \| \|	Merge branch 'ac-graphql-stats' into 'master'	Dmitriy Zaporozhets	2019-06-03	1	-0/+18
\|\ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Add Namespace and ProjectStatistics to GraphQL API See merge request gitlab-org/gitlab-ce!28277
\| * \| \| \| \| \| \|	Add Namespace and ProjectStatistics to GraphQL API	Alessio Caiazza	2019-06-03	1	-0/+18
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	We can query namespaces, and nested projects. Projects now exposes statistics
* \| \| \| \| \| \| \|	Fix port validations in .gitlab-webide.ymlce-fj-11886-fix-port-validation	Francisco Javier López	2019-06-01	1	-0/+10
\|/ / / / / / /
* \| \| \| \| \| \|	Merge branch 'osw-reset-merge-status-from-mergeable-mrs' into 'master'	Douglas Barbosa Alexandre	2019-05-31	1	-0/+48
\|\ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Reset merge status from mergeable MRs See merge request gitlab-org/gitlab-ce!28843
\| * \| \| \| \| \| \|	Reset merge status from mergeable MRs	Oswaldo Ferreira	2019-05-31	1	-0/+48
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Adds migrations to reset the merge_status of opened, mergeable MRs. That's required by https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/28513 so we're able to sync the status update along merge-ref, without leaving MRs with a stale merge-ref.
* \| \| \| \| \| \| \|	Merge branch 'dz-scope-project-routes-3' into 'master'	Lin Jen-Shin	2019-05-31	1	-1/+1
\|\ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Move some project routes under - scope See merge request gitlab-org/gitlab-ce!28830
\| * \| \| \| \| \| \| \|	Fix specs after routing change	Dmitriy Zaporozhets	2019-05-29	1	-1/+1
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
* \| \| \| \| \| \| \| \|	Merge branch 'gitaly-version-v1.43.0' into 'master'	Bob Van Landuyt	2019-05-31	3	-68/+0
\|\ \ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Upgrade Gitaly to v1.43.0 See merge request gitlab-org/gitlab-ce!28867
\| * \| \| \| \| \| \| \| \|	Remove hook directory requirement from Shellgitaly-version-v1.43.0	Zeger-Jan van de Weg	2019-05-30	3	-68/+0
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	It used to be the case that GitLab created symlinks for each repository to one copy of the Git hooks, so these ran when required. This changed to set the hooks dynamically on Gitaly when invoking Git. The side effect is that we didn't need all these symlinks anymore, which Gitaly doesn't create anymore either. Now that means that the tests in GitLab-Rails should test for it either. Related: https://gitlab.com/gitlab-org/gitaly/issues/1392#note_175619926
* \| \| \| \| \| \| \| \| \|	Merge branch '59587-add-graphql-logging' into 'master'	Sean McGivern	2019-05-31	2	-0/+65
\|\ \ \ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Add logging to GraphQL Closes #59587 See merge request gitlab-org/gitlab-ce!27885
\| * \| \| \| \| \| \| \| \| \|	Apply reviewer feedback59587-add-graphql-logging	charlie ablett	2019-05-31	2	-14/+9
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	- Comply doc with guidelines - Improve tests for readability and completeness - Separate out phases visually with newlines - Add `format_message` test - test readability - code and test structure/styling - static query analyzers - call `as_json` on `provided_variables` - add exception handling
\| * \| \| \| \| \| \| \| \| \|	Move complexity/depth to `final_value`	charlieablett	2019-05-30	2	-15/+7
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Tidy tests according to reviewer comments. Move complexity and depth calls from `initial_value` to `final_value` Log variables as json
\| * \| \| \| \| \| \| \| \| \|	Call analyzers from LoggerAnalyzer	charlieablett	2019-05-30	2	-25/+22
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	- Add changelog file - Fix failing tests
\| * \| \| \| \| \| \| \| \| \|	Add GraphQL logging feature flag	charlieablett	2019-05-30	1	-1/+18
\| \| \| \| \| \| \| \| \| \| \|
\| * \| \| \| \| \| \| \| \| \|	Restructure complexity analyzer	charlieablett	2019-05-30	1	-9/+31
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Remove instance variables for class re-use, test individual methods, use `monotonic_time`
\| * \| \| \| \| \| \| \| \| \|	Implement logger analyzer	charlieablett	2019-05-30	2	-9/+30
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	- Modify GraphqlLogger to subclass JsonLogger - Replace the single-line analyser with one that can log all the GraphQL query related information in one place. - Implement analyzer behavior with spec
\| * \| \| \| \| \| \| \| \| \|	New logfile for graphql queries	charlieablett	2019-05-30	1	-0/+21
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Specify dedicated logfile and logger class for GraphQL queries. Move complexity analyzer to a dedicated class.
* \| \| \| \| \| \| \| \| \| \|	Setup Phabricator import	Bob Van Landuyt	2019-05-31	16	-14/+669
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	This sets up all the basics for importing Phabricator tasks into GitLab issues. To import all tasks from a Phabricator instance into GitLab, we'll import all of them into a new project that will have its repository disabled. The import is hooked into a regular ProjectImport setup, but similar to the GitHub parallel importer takes care of all the imports itself. In this iteration, we're importing each page of tasks in a separate sidekiq job. The first thing we do when requesting a new page of tasks is schedule the next page to be imported. But to avoid deadlocks, we only allow a single job per worker type to run at the same time. For now we're only importing basic Issue information, this should be extended to richer information.
* \| \| \| \| \| \| \| \| \| \|	Generate lets_encrypt_private_key on the fly	Vladimir Shushlin	2019-05-31	1	-3/+43
\| \|_\|_\|/ / / / / / / \|/\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Remove migration generating lets encrypt key Don't generate private_key if database is readonly For reference: This reverts commit 988a7f70489b99383b95e9f271a2caf6bb5b3a44. This reverts commit 21acbe531592d55caf0e5b8716a3b551dafd6233.
* \| \| \| \| \| \| \| \| \|	Extract roulette to its own module	Lin Jen-Shin	2019-05-30	3	-103/+111
\|/ / / / / / / / / \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	So it's more modular and extensible
* \| \| \| \| \| \| \| \|	Merge branch 'add-wiki-size-to-statistics' into 'master'	Stan Hu	2019-05-29	1	-0/+62
\|\ \ \ \ \ \ \ \ \ \| \|/ / / / / / / / \|/\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Add wiki size to project statistics Closes #57822 See merge request gitlab-org/gitlab-ce!25321
\| * \| \| \| \| \| \| \|	Add wiki size to project statistics	Peter Marko	2019-05-29	1	-0/+62
\| \|/ / / / / / /
* \| \| \| \| \| \| \|	Added rack-timeout for Puma	Jan Provaznik	2019-05-29	1	-0/+58
\|/ / / / / / / \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	It assures that requests are aborted after 60 seconds, otherwise an exception is raised. This exception is logged by Sentry, also there is a Prometheus counter for measuring number of requests in each state.
* \| \| \| \| \| \|	Add Puma sampler	Jan Provaznik	2019-05-29	1	-0/+96
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	This sampler gathers Puma-specific metrics which can be used by Prometheus then.
* \| \| \| \| \| \|	Fix order dependency with user params during imports	Liam McAndrew	2019-05-28	1	-2/+11
\|/ / / / / /