summaryrefslogtreecommitdiff
path: root/spec
Commit message (Expand)AuthorAgeFilesLines
* Fix specs, backportingValery Sizov2019-12-0910-43/+44
* Handle Stored XSS for Grafana URL in settingsDavid Wilkins2019-10-244-1/+130
* EE port: Fix private feature Elasticsearch leakMark Chao2019-10-014-0/+197
* Merge branch 'fix_expired_gpg_key_specs' into 'master'Stan Hu2019-09-302-151/+270
* Merge branch 'security-sarcila-verify-saml-request-origin-12-1' into '12-1-st...GitLab Release Tools Bot2019-09-265-36/+191
|\
| * Validate that SAML requests are originated from gitlabSebastian Arcila Valenzuela2019-09-165-36/+191
* | Merge branch 'security-xss-mermaid-12-1' into '12-1-stable'GitLab Release Tools Bot2019-09-261-2/+3
|\ \
| * | Upgrade mermaid to prevent xss attackRajat Jain2019-09-101-2/+3
| |/
* | Merge branch 'security-12717-fix-confidential-issue-assignee-visible-to-guest...GitLab Release Tools Bot2019-09-261-0/+41
|\ \
| * | Display only participants that user has permission to seeAlexandru Croitor2019-09-201-0/+41
* | | Merge branch 'security-bypass-email-verification-using-salesforce-12-1' into ...GitLab Release Tools Bot2019-09-263-23/+53
|\ \ \
| * | | Bring back unary operatorMałgorzata Ksionek2019-09-111-2/+2
| * | | Switch unary operator to more verbose wayMałgorzata Ksionek2019-09-111-2/+2
| * | | Bring back unary operatorMałgorzata Ksionek2019-09-111-2/+2
| * | | Add checking for email_verified keyMałgorzata Ksionek2019-09-113-23/+53
| | |/ | |/|
* | | Merge branch 'security-mermaid-block-12-1' into '12-1-stable'GitLab Release Tools Bot2019-09-261-0/+39
|\ \ \
| * | | Only render fixed number of mermaid blocksRajat Jain2019-09-191-0/+39
| |/ /
* | | Merge branch 'security-12718-project-milestones-disclosed-via-groups-12-1-ce'...GitLab Release Tools Bot2019-09-262-2/+101
|\ \ \
| * | | Hide disabled project milestones in project settings on group levelAlexandru Croitor2019-09-262-2/+101
| | |/ | |/|
* | | Merge branch 'security-64938-dont-disclose-path-12-1-ce' into '12-1-stable'GitLab Release Tools Bot2019-09-261-0/+29
|\ \ \
| * | | Redirect user to root path after unsubscribing from private resourceAlexandru Croitor2019-09-201-0/+29
| |/ /
* | | Merge branch 'security-12630-private-system-note-disclosed-in-graphql-12-1-ce...GitLab Release Tools Bot2019-09-262-0/+162
|\ \ \
| * | | Add policy check if cross reference system notes are accessibleAlexandru Croitor2019-09-252-0/+162
| |/ /
* | | Merge branch 'security-fp-stop-jobs-when-blocking-user-12-1' into '12-1-stable'GitLab Release Tools Bot2019-09-262-1/+40
|\ \ \
| * | | Cancel all running CI jobs when user is blockedFabio Pitino2019-09-242-1/+40
| |/ /
* | | Filter not accessible label eventsJan Provaznik2019-09-243-31/+209
|/ /
* | Merge branch 'sh-fix-captcha-state-pollution-spec' into 'master'12-1-stable-patch-10Mayra Cabrera2019-09-191-7/+1
|/
* Use `stub_full_request` to fix spec failureHeinrich Lee Yu2019-08-283-16/+24
* Avoid exposing unaccessible repo data upon GFM processingOswaldo Ferreira2019-08-262-2/+76
* Merge branch 'security-hide_merge_request_ids_on_emails-12-1' into '12-1-stable'GitLab Release Tools Bot2019-08-262-18/+78
|\
| * Prevent disclosure of merge request id via emailFelipe Artur2019-08-212-18/+78
* | Merge branch 'security-64711-fix-commit-todos-12-1' into '12-1-stable'GitLab Release Tools Bot2019-08-261-16/+105
|\ \
| * | Send TODOs for comments on commits correctlyNick Thomas2019-08-231-16/+105
| |/
* | Add captcha if there are multiple failed login attemptsMałgorzata Ksionek2019-08-264-18/+171
* | Merge branch 'security-12-1-enable-image-proxy' into '12-1-stable'GitLab Release Tools Bot2019-08-2610-0/+323
|\ \
| * | Add support for using a Camo proxy serverBrett Walker2019-08-1510-0/+323
* | | Merge branch 'security-61974-limit-issue-comment-size-12-1' into '12-1-stable'GitLab Release Tools Bot2019-08-264-4/+72
|\ \ \
| * | | Limit the size of issuable description and commentsAlexandru Croitor2019-08-224-4/+72
| | |/ | |/|
* | | Merge branch 'security-mr-head-pipeline-leak-12-1' into '12-1-stable'GitLab Release Tools Bot2019-08-261-4/+26
|\ \ \
| * | | Permission fix for MergeRequestsController#pipeline_statusdrew cimino2019-08-121-4/+26
| |/ /
* | | Merge branch 'security-katex-dos-12-1' into '12-1-stable'GitLab Release Tools Bot2019-08-261-2/+4
|\ \ \
| * | | Enforce max chars and max render time in markdown mathMartin Hanzel2019-08-061-2/+4
| |/ /
* | | Merge branch 'security-ssrf-kubernetes-dns-12-1' into '12-1-stable'GitLab Release Tools Bot2019-08-263-18/+215
|\ \ \
| * | | Override hostname when connecting via KubeclientThong Kuah2019-08-043-18/+215
| | |/ | |/|
* | | Merge branch 'security-fix-html-injection-for-label-description-ce-12-1' into...GitLab Release Tools Bot2019-08-262-0/+17
|\ \ \
| * | | Fix HTML injection for label descriptionPatrick Derichs2019-08-052-0/+17
| |/ /
* | | Merge branch 'security-2853-prevent-comments-on-private-mrs-12-1' into '12-1-...GitLab Release Tools Bot2019-08-263-71/+357
|\ \ \
| * | | Prevent unauthorised comments on merge requestsAlex Kalderimis2019-08-073-71/+357
| | |/ | |/|
* | | Merge branch 'security-fix_jira_ssrf_vulnerability-12-1' into '12-1-stable'GitLab Release Tools Bot2019-08-261-0/+5
|\ \ \
| * | | Fix DNS rebind vulnerability for JIRA integrationFelipe Artur2019-08-081-0/+5
| |/ /
View Lorry Controller Status