summaryrefslogtreecommitdiff
path: root/spec
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'master' of dev.gitlab.org:gitlab/gitlabhqRobert Speicher2019-07-2917-141/+568
|\
| * Extract SanitizeNodeLink and apply to WikiLinkFilterKerri Miller2019-07-263-42/+151
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The SanitizationFilter was running before the WikiFilter. Since WikiFilter can modify links, we could see links that _should_ be stopped by SanatizationFilter being rendered on the page. I (kerrizor) had previously addressed the bug in: https://gitlab.com/gitlab-org/gitlab-ee/commit/7bc971915bbeadb950bb0e1f13510bf3038229a4 However, an additional exploit was discovered after that was merged. Working through the issue, we couldn't simply shuffle the order of filters, due to some implicit assumptions about the order of filters, so instead we've extracted the logic that sanitizes a Nokogiri-generated Node object, and applied it to the WikiLinkFilter as well. On moving filters around: Once we start moving around filters, we get cascading failures; fix one, another one crops up. Many of the existing filters in the WikiPipeline chain seem to assume that other filters have already done their work, and thus operate on a "transform anything that's left" basis; WikiFilter, for instance, assumes any link it finds in the markdown should be prepended with the wiki_base_path.. but if it does that, it also turns `href="@user"` into `href="/path/to/wiki/@user"`, which the UserReferenceFilter doesn't see as a user reference it needs to transform into a user profile link. This is true for all the reference filters in the WikiPipeline.
| * Merge branch 'security-fix-badges-leaked-to-unauthorized-users' into 'master'GitLab Release Tools Bot2019-07-261-30/+94
| |\ | | | | | | | | | | | | | | | | | | Don't display badges when builds are restricted Closes #2864 See merge request gitlab/gitlabhq!3175
| | * Don't display badges when builds are restrictedFabio Pitino2019-07-111-30/+94
| | | | | | | | | | | | | | | | | | | | | | | | Badges were leaked to unauthorized users even when Public Builds project setting is disabled. Added guard clause to the controller to check if user can read build.
| * | Merge branch 'security-github-ssrf-redirect' into 'master'GitLab Release Tools Bot2019-07-261-0/+68
| |\ \ | | | | | | | | | | | | | | | | Do not allow localhost url redirection in GitHub Integration See merge request gitlab/gitlabhq!3188
| | * | Do not allow localhost url redirection in GitHub Integrationmanojmj2019-07-051-0/+68
| | | |
| * | | Merge branch 'security-remove-take-trigger-ownership-feature' into 'master'GitLab Release Tools Bot2019-07-262-51/+0
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Drop feature to take ownership of a trigger token Closes #2868 See merge request gitlab/gitlabhq!3198
| | * | | Drop feature to take ownership of a trigger tokenFabio Pitino2019-07-102-51/+0
| | | |/ | | |/| | | | | | | | | | | | | | | | | | | | | Removing API and frontend interactions that allowed users to take ownership of a trigger token. Removed mentions from the documentation.
| * | | Merge branch 'security-mr-pipeline-permissions' into 'master'GitLab Release Tools Bot2019-07-261-4/+94
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MR pipeline permissions Closes #2871 See merge request gitlab/gitlabhq!3204
| | * | | Use MergeRequest#source_project as permissions reference for ↵drew cimino2019-07-051-4/+94
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MergeRequest#all_pipelines MergeRequest#all_pipelines fetches Ci::Pipeline records from the source project, so we should specifically check that project for permissions. This was already happening for intra-project merge requests, but in the event that the target and source projects both have private builds, we should ensure that the project permissions are respected.
| * | | | Merge branch 'security-dns-ssrf-bypass' into 'master'GitLab Release Tools Bot2019-07-262-12/+33
| |\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Server Side Request Forgery mitigation bypass Closes #2872 See merge request gitlab/gitlabhq!3205
| | * | | | Fix Server Side Request Forgery mitigation bypassFrancisco Javier López2019-07-152-12/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When we can't resolve the hostname or it is invalid, we shouldn't even perform the request. This fix also fixes the problem the SSRF rebinding attack. We can't stub feature flags outside example blocks. Nevertheless, there are some actions that calls the UrlBlocker, that are performed outside example blocks, ie: `set` instruction. That's why we have to use some signalign mechanism outside the scope of the specs.
| * | | | | Merge branch 'security-60551-fix-upload-scope' into 'master'GitLab Release Tools Bot2019-07-264-0/+41
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | Queries for Upload should be scoped by model See merge request gitlab/gitlabhq!3229
| | * | | | | Queries for Upload should be scoped by modelAdam Hegyi2019-07-114-0/+41
| | | |_|/ / | | |/| | |
| * | | | | Merge branch 'security-hide_moved_issue_id' into 'master'GitLab Release Tools Bot2019-07-261-0/+33
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not show moved issue ids for user not authorized Closes #2878 See merge request gitlab/gitlabhq!3230
| | * | | | | Do not show moved issue ids for user not authorizedFelipe Artur2019-07-111-0/+33
| | |/ / / / | | | | | | | | | | | | | | | | | | Do not show moved issue id for users that cannot read issue
| * | | | | Merge branch 'security-bvl-filter-mr-params' into 'master'GitLab Release Tools Bot2019-07-262-2/+56
| |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Filter params in MR build service Closes #2879 See merge request gitlab/gitlabhq!3237
| | * | | | | Filter params in MR build serviceBob Van Landuyt2019-07-172-2/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Reusing the existing `IssuableBaseService#filter_params` which uses the policies to determine what params a user can set, and which values it can be set to. This also removed the need for the seperate call to `IssuableBaseService#ensure_milestone_available`. The `Issues::BuildService` does not suffer from this because it limits the params that are assignable to the `title`, `description` and `milestone_id`.
* | | | | | | Merge branch 'resolve-spec-differences' into 'master'Lin Jen-Shin2019-07-295-9/+53
|\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Resolve EE specific differences in the spec/ directory See merge request gitlab-org/gitlab-ce!31109
| * | | | | | | Fix whitespace in wiki link filtering specsresolve-spec-differencesYorick Peterse2019-07-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This ensures this spec is the same in both CE and EE.
| * | | | | | | Make usage content spec the same for CE and EEYorick Peterse2019-07-291-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This changes the spec in question so that it is the same for both CE and EE. This requires an `if Gitlab.ee?` since EE requires that we stub an EE specific module, but doing so in CE will break the spec there.
| * | | | | | | Make protected tags spec the same for CE and EEYorick Peterse2019-07-291-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This changes a protected tags feature spec so that it is the same in both CE and EE. This requires the use of a `if Gitlab.ee?` check, as the added lines don't work in CE but do work in EE. Removing them entirely in turn breaks the EE spec.
| * | | | | | | Backport ToDo feature specs from EEYorick Peterse2019-07-291-7/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This ensures that both CE and EE have the same specs.
| * | | | | | | Backport EE changes for the schema specsYorick Peterse2019-07-291-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This backports two EE specific changes made to the schema changes. We do not yet backport the EE prepend, as this will/can be done when https://gitlab.com/gitlab-org/gitlab-ce/issues/58170 is implemented.
* | | | | | | | Merge branch 'remove-peek-pg' into 'master'Stan Hu2019-07-291-2/+25
|\ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace peek-pg with our own implementation Closes #44441 See merge request gitlab-org/gitlab-ce!31187
| * | | | | | | | Replace peek-pg with our own implementationremove-peek-pgSean McGivern2019-07-261-2/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This uses an ActiveRecord subscriber to get queries and calculate the total query time from that. This means that the total will always be consistent with the queries in the table. It does however mean that we could potentially miss some queries that don't go through ActiveRecord. Making this change also allows us to unify the response JSON a little bit, making the frontend slightly simpler as a result.
* | | | | | | | | Merge branch 'resolve-scripts-differences' into 'master'Lin Jen-Shin2019-07-291-0/+6
|\ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Backport EE changes made to the scripts/ directory See merge request gitlab-org/gitlab-ce!31015
| * | | | | | | | | Backport EE changes made to the scripts/ directoryresolve-scripts-differencesYorick Peterse2019-07-291-0/+6
| | |/ / / / / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This backport changes made by EE to the files in the scripts/ directory. This comes with a few changes to some scripts to make them work in the single codebase setup.
* | | | | | | | | Merge branch 'ab-remove-postgresql-switches' into 'master'Nick Thomas2019-07-295-87/+22
|\ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Further remove `if postgresql?` branches Closes #65054 See merge request gitlab-org/gitlab-ce!31102
| * | | | | | | | | Further remove code branches by database typeAndreas Brandl2019-07-295-87/+22
| |/ / / / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We dropped MySQL support and a lot of mysql specific code has been removed in https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/29608. This comes in from the other direction and removes any `if postgresql?` branches.
* | | | | | | | | Adds direct monitoring for sidekiq metricsRyan Cobb2019-07-291-0/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds diirect monitoring for sidekiq metrics. This is done via sidekiq middleware and a sampler to pull from sidekiqs api.
* | | | | | | | | Merge branch 'add-git-blame-api' into 'master'Nick Thomas2019-07-291-0/+162
|\ \ \ \ \ \ \ \ \ | |/ / / / / / / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Expose git blame in api Closes #51345 See merge request gitlab-org/gitlab-ce!30675
| * | | | | | | | Add git blame apiOleg Zubchenko2019-07-261-0/+162
| | | | | | | | |
* | | | | | | | | Added navbar searches usage ping counterFrancisco Javier López2019-07-293-5/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added usage ping counter when the user makes a search through the navbar search component.
* | | | | | | | | Merge branch 'frozen_string_spec_features' into 'master'Rémy Coutable2019-07-29521-4/+1046
|\ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add frozen_string_literal to spec/features See merge request gitlab-org/gitlab-ce!31131
| * | | | | | | | | Fix can't modify frozen String errorsfrozen_string_spec_featuresThong Kuah2019-07-264-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use unary plus as recommended by Performance/UnfreezeString cop
| * | | | | | | | | Add frozen_string_literal to spec/featuresThong Kuah2019-07-26521-0/+1042
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Using the sed script from https://gitlab.com/gitlab-org/gitlab-ce/issues/59758
* | | | | | | | | | Add Job specific variablesMatija Čupić2019-07-2910-8/+199
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds Job specific variables to facilitate specifying variables when running manual jobs.
* | | | | | | | | | Merge branch ↵Kushal Pandya2019-07-291-0/+35
|\ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | '61787-the-colour-selector-for-broadcast-messages-should-provide-a-few-default-options-with-descriptive-labels-like-red-green-blue' into 'master' Resolve "Add color selector for broadcast messages" Closes #61787 See merge request gitlab-org/gitlab-ce!30988
| * | | | | | | | | | Add color utils with relevant testsAmmar Alakkad2019-07-261-0/+35
| | | | | | | | | | |
* | | | | | | | | | | Remove unused Clusters::RefreshServiceTiger2019-07-293-198/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also removes all logic from ClusterConfigureWorker and ClusterProjectConfigureWorker, which are also no longer used.
* | | | | | | | | | | Revert "Merge branch '52123-issuable-actions-notesfinder-pderichs' into ↵Stan Hu2019-07-277-217/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'master'" This reverts merge request !29733
* | | | | | | | | | | Merge branch '52123-issuable-actions-notesfinder-pderichs' into 'master'Stan Hu2019-07-267-7/+217
|\ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use NotesFinder to fetch notes in module IssuableActions Closes #52123 See merge request gitlab-org/gitlab-ce!29733
| * | | | | | | | | | | Use NotesFinder in module IssuableActionsPatrick Derichs2019-07-267-7/+217
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add spec for concern IssuableActions Add shared samples for discussions endpoint Add schema validations for discussions Fix rubocop style issue Make target assignable Use new possibility to provide target
* | | | | | | | | | | | Merge branch '19186-redirect-wiki-git-route-to-wiki' into 'master'Stan Hu2019-07-261-0/+24
|\ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Redirect project.wiki.git to project wiki home See merge request gitlab-org/gitlab-ce!31085
| * | | | | | | | | | | | Redirect project.wiki.git to project wiki home19186-redirect-wiki-git-route-to-wikiLuke Duncalfe2019-07-261-0/+24
| | |_|/ / / / / / / / / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://gitlab.com/gitlab-org/gitlab-ce/issues/19186
* | | | | | | | | | | | Changes capybara selector to qa-selectorTanya Pazitny2019-07-261-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Otherwise capybara hits ambiguous match.
* | | | | | | | | | | | Merge branch 'frozen_string_spec_lib' into 'master'Stan Hu2019-07-26395-18/+808
|\ \ \ \ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add frozen_string_literal to spec/lib (part 1) See merge request gitlab-org/gitlab-ce!31130
| * | | | | | | | | | | | Fix cannot modify frozen stringfrozen_string_spec_libThong Kuah2019-07-264-18/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Note that Performance/UnfreezeString recommends unary plus over "".dup, but unary plus has lower precedence so we have to use parenthesis
| * | | | | | | | | | | | Add frozen_string_literal to spec/lib (part 1)Thong Kuah2019-07-26395-0/+790
| |/ / / / / / / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Using the sed script from https://gitlab.com/gitlab-org/gitlab-ce/issues/59758
View Lorry Controller Status