delta/gitlab/gitlab-ce.git - gitlab.com: gitlab-org/gitlab-ce.git

	Commit message (Collapse)	Author	Age	Files	Lines
*	Introduce sidekiq worker for auto merge processintroduce-auto-merge-process-worker	Shinya Maeda	2019-06-04	3	-27/+65
\| \| \| \| \|	As we have a central domain for auto merge process today, we should use a single worker for any auto merge process.
*	Merge branch 'sh-fix-import-url-update' into 'master'	Thong Kuah	2019-06-03	1	-0/+12
\|\ \| \| \| \| \| \| \| \| \| \| \| \|	Fix project settings not being able to update Closes #62708 See merge request gitlab-org/gitlab-ce!29097
\| *	Fix project settings not being able to update	Stan Hu	2019-06-03	1	-0/+12
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Previously import_url would always be present in the update parameters, which would cause the validation to fail. We now only include this parameter only if there is URL given. Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/62708
* \|	Comply with `no-implicit-coercion` rule (CE)	Nathan Friend	2019-06-03	3	-3/+7
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	This commit is the result of running `yarn eslint --fix` after enabling the `no-implicit-coercion` ESLint rule. This rule has been added to our ESLint config here: https://gitlab.com/gitlab-org/gitlab-eslint-config/merge_requests/14
* \|	Backporting EE fix	rossfuhrman	2019-06-03	1	-36/+38
\|/
*	Move boardsStore.moving to BoardList component	Winnie Hellmann	2019-06-03	1	-0/+12
\|
*	Merge branch 'master' of dev.gitlab.org:gitlab/gitlabhq	Robert Speicher	2019-06-03	5	-2/+72
\|\
\| *	Merge branch 'security-60143-address-xss-issue-master' into 'master'	Robert Speicher	2019-06-03	1	-0/+42
\| \|\ \| \| \| \| \| \| \| \| \| \| \| \|	Reject slug+uri concat if slug is deemed unsafe See merge request gitlab/gitlabhq!3108
\| \| *	Reject slug+uri concat if slug is deemed unsafe	Kerri Miller	2019-05-24	1	-0/+42
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	First reported: https://gitlab.com/gitlab-org/gitlab-ce/issues/60143 When the page slug is "javascript:" and we attempt to link to a relative path (using `.` or `..`) the code will concatenate the slug and the uri. This MR adds a guard to that concat step that will return `nil` if the incoming slug matches against any of the "unsafe" slug regexes; currently this is only for the slug "javascript:" but can be extended if needed. Manually tested against a non-exhaustive list from OWASP of common javascript XSS exploits that have to to with mangling the "javascript:" method, and all are caught by this change or by existing code that ingests the user-specified slug.
\| * \|	Merge branch 'security-58856-persistent-xss-in-note-objects' into 'master'	Robert Speicher	2019-06-03	4	-2/+30
\| \|\ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Persistent XSS in note objects CE See merge request gitlab/gitlabhq!3075
\| \| * \|	Remove unused fixture lines	Tiger	2019-05-28	1	-2/+0
\| \| \| \|
\| \| * \|	Add `html` to sensitive words	charlieablett	2019-05-01	2	-2/+3
\| \| \| \|
\| \| * \|	Remove accidental regressions	charlieablett	2019-04-30	1	-5/+6
\| \| \| \|
\| \| * \|	Ensure Issue & MR note_html cannot be imported	Ash McKenzie	2019-04-30	2	-16/+16
\| \| \| \|
\| \| * \|	Add disallowed fields to AttributeCleaner	charlieablett	2019-04-24	2	-10/+8
\| \| \| \|
\| \| * \|	Re-stub stubbed method calls	charlieablett	2019-04-23	1	-3/+9
\| \| \| \|
\| \| * \|	Exclude fields from note import	charlieablett	2019-04-23	2	-2/+26
\| \| \| \|
* \| \| \|	Merge branch 'osw-sync-merge-ref-upon-mergeability-check' into 'master'	Douwe Maan	2019-06-03	5	-141/+251
\|\ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Automatically update MR merge-ref along merge status Closes #58495 See merge request gitlab-org/gitlab-ce!28513
\| * \| \| \|	Add payload to the service response	Oswaldo Ferreira	2019-05-31	2	-0/+111
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	This introduces payload to the ServiceResponse with the merge ref HEAD commit data
\| * \| \| \|	Automatically update MR merge-ref along merge status	Oswaldo Ferreira	2019-05-31	4	-141/+140
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	This couples the code that transitions the `MergeRequest#merge_status` and refs/merge-requests/:iid/merge ref update. In general, instead of directly telling `MergeToRefService` to update the merge ref, we should rely on `MergeabilityCheckService` to keep both the merge status and merge ref synced. Now, if the merge_status is `can_be_merged` it means the merge-ref is also updated to the latest. We've also updated the logic to be more systematic and less user-based.
* \| \| \| \|	Merge branch '58269-separate-update-patch' into 'master'	Mike Greiling	2019-06-03	3	-60/+180
\|\ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Do not display Update app button when saving Knative domain name Closes #58269 See merge request gitlab-org/gitlab-ce!28904
\| * \| \| \| \|	Add updateSuccessful/Failed props to knative app	Enrique Alcantara	2019-05-30	1	-0/+2
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	They are used to indicate when knative domain name has changed
\| * \| \| \| \|	Extract knative domain editor into a component	Enrique Alcantara	2019-05-30	2	-60/+178
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	The new component also implements several improvements in the knative domain editor workflow: - Display a loading spinner when saving changes in the domain name - Display success toast message indicating changes were saved successfully. - Display error message in the contraty occurs
* \| \| \| \| \|	Cleans up UpdateProjectStatistics concern	Mayra Cabrera	2019-06-03	2	-10/+11
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	- Renames attributes from stat to project_statistiscs_name and attribute to statistic_attribute - Reordes methods on UpdateProjectStatistics concern - Removes unused module from Ci::Build
* \| \| \| \| \|	Merge branch 'issafeurl-utility' into 'master'	Kushal Pandya	2019-06-03	1	-0/+84
\|\ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Add global isSafeURL utility See merge request gitlab-org/gitlab-ce!28943
\| * \| \| \| \| \|	Add global isSafeURL utilityissafeurl-utility	Paul Gascou-Vaillancourt	2019-06-03	1	-0/+84
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	- Added isSafeURL utility based on prior work in gitlab-ee - Also added isAbsoluteOrRootRelative() and getBaseURL() utils, needed by isSafeURL - Removed URL() fallback because URL() is now polyfilled - Updated specs
* \| \| \| \| \| \|	Move NoteApp tests to Jest	Winnie Hellmann	2019-06-03	2	-106/+103
\| \| \| \| \| \| \|
* \| \| \| \| \| \|	Merge dev.gitlab.org master into GitLab.com master	Yorick Peterse	2019-06-03	41	-128/+883
\|\ \ \ \ \ \ \ \| \| \|_\|_\|/ / / \| \|/\| \| \| \| \|
\| * \| \| \| \| \|	Merge branch 'security-jej/prevent-web-sign-in-bypass' into 'master'	GitLab Release Tools Bot	2019-06-03	1	-1/+33
\| \|\ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Prevent password sign in restriction bypass See merge request gitlab/gitlabhq!2702
\| \| * \| \| \| \| \|	Prevent password sign in restriction bypass	James Edwards-Jones	2019-05-21	1	-1/+33
\| \| \| \| \| \| \| \|
\| * \| \| \| \| \| \|	Merge branch 'security-fix_milestones_search_api_leak' into 'master'	GitLab Release Tools Bot	2019-06-03	3	-4/+83
\| \|\ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Resolve: Milestones leaked via search API Closes #2822 See merge request gitlab/gitlabhq!2997
\| \| * \| \| \| \| \| \|	Resolve: Milestones leaked via search API	Felipe Artur	2019-05-20	3	-4/+83
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Fix milestone titles being leaked using search API when users cannot read milestones
\| * \| \| \| \| \| \| \|	Merge branch 'security-60039' into 'master'	GitLab Release Tools Bot	2019-06-03	5	-31/+106
\| \|\ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Disallow invalid MR branch name See merge request gitlab/gitlabhq!3052
\| \| * \| \| \| \| \| \| \|	Refactor spec to not use truthy or falsey	Mark Chao	2019-05-03	1	-58/+58
\| \| \| \| \| \| \| \| \| \|
\| \| * \| \| \| \| \| \| \|	Use full ref when creating MR pipeline in specs	Mark Chao	2019-05-03	1	-3/+3
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Continuation of 426488b7218e85ce69868ae4628801af2322b74a
\| \| * \| \| \| \| \| \| \|	Validate MR branch names	Mark Chao	2019-05-03	4	-28/+103
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Prevents refspec as branch name, which would bypass branch protection when used in conjunction with rebase. HEAD seems to be a special case with lots of occurrence, so it is considered valid for now. Another special case is `refs/head/*`, which can be imported.
\| * \| \| \| \| \| \| \| \|	Merge branch 'security-id-leaked-password-in-import-url-frontend' into 'master'	GitLab Release Tools Bot	2019-06-03	4	-2/+105
\| \|\ \ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Handling password on import by url page See merge request gitlab/gitlabhq!3061
\| \| * \| \| \| \| \| \| \| \|	Handling password on import by url page	Sam Bigelow	2019-05-29	1	-2/+12
\| \| \| \| \| \| \| \| \| \| \|
\| \| * \| \| \| \| \| \| \| \|	Hide password on import by url form	Igor Drozdov	2019-05-29	3	-0/+93
\| \| \| \| \| \| \| \| \| \| \|
\| * \| \| \| \| \| \| \| \| \|	Merge branch 'dm-http-hostname-override' into 'master'	GitLab Release Tools Bot	2019-06-03	25	-66/+405
\| \|\ \ \ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Protect Gitlab::HTTP against DNS rebinding attack See merge request gitlab/gitlabhq!3071
\| \| * \| \| \| \| \| \| \| \| \|	Add DNS rebinding protection settings	Oswaldo Ferreira	2019-05-30	4	-1/+101
\| \| \| \| \| \| \| \| \| \| \| \|
\| \| * \| \| \| \| \| \| \| \| \|	Protect Gitlab::HTTP against DNS rebinding attack	Douwe Maan	2019-05-30	23	-65/+304
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Gitlab::HTTP now resolves the hostname only once, verifies the IP is not blocked, and then uses the same IP to perform the actual request, while passing the original hostname in the `Host` header and SSL SNI field.
\| * \| \| \| \| \| \| \| \| \| \|	Merge branch 'security-fix-project-existence-disclosure-master' into 'master'	GitLab Release Tools Bot	2019-06-03	1	-14/+18
\| \|\ \ \ \ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Fix url redaction for issue links See merge request gitlab/gitlabhq!3091
\| \| * \| \| \| \| \| \| \| \| \| \|	Fix url redaction for issue links	Patrick Derichs	2019-05-03	1	-14/+18
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Add changelog entry Add missing href to all redactor specs and removed href assignment Remove obsolete spec If original_content is given, it should be used for link content
\| * \| \| \| \| \| \| \| \| \| \| \|	Merge branch 'security-unsubscribing-from-issue' into 'master'	GitLab Release Tools Bot	2019-06-03	1	-10/+99
\| \|\ \ \ \ \ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Hide issue title on unsubscribe for anonymous users See merge request gitlab/gitlabhq!3097
\| \| * \| \| \| \| \| \| \| \| \| \| \|	Hide issue title on unsubscribe for anonymous users	Alexandru Croitor	2019-05-16	1	-10/+99
\| \| \| \| \| \| \| \| \| \| \| \| \| \|
\| * \| \| \| \| \| \| \| \| \| \| \| \|	Merge branch 'security-fix-confidential-issue-label-visibility-master' into ↵	GitLab Release Tools Bot	2019-06-03	1	-0/+34
\| \|\ \ \ \ \ \ \ \ \ \ \ \ \ \| \| \|_\|_\|/ / / / / / / / / / \| \|/\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	'master' Fix confidential issue label disclosure on milestone view See merge request gitlab/gitlabhq!3098
\| \| * \| \| \| \| \| \| \| \| \| \| \|	Fix confidential issue label disclosure on milestone view	Patrick Derichs	2019-05-14	1	-0/+34
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Add changelog entry Method should be public Use milestonish method Use render data to filter labels Add specs for label visibility on milestone
* \| \| \| \| \| \| \| \| \| \| \| \| \|	Merge branch 'ac-graphql-stats' into 'master'	Dmitriy Zaporozhets	2019-06-03	10	-5/+256
\|\ \ \ \ \ \ \ \ \ \ \ \ \ \ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Add Namespace and ProjectStatistics to GraphQL API See merge request gitlab-org/gitlab-ce!28277
\| * \| \| \| \| \| \| \| \| \| \| \| \| \|	Add Namespace and ProjectStatistics to GraphQL API	Alessio Caiazza	2019-06-03	10	-5/+256
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	We can query namespaces, and nested projects. Projects now exposes statistics