summaryrefslogtreecommitdiff
path: root/spec
Commit message (Collapse)AuthorAgeFilesLines
* Add latest changes from gitlab-org/gitlab@12-4-stable-eeGitLab Bot2019-11-0414-28/+92
|
* Merge branch 'security-mask-sentry-token-12-4-ce' into '12-4-stable'GitLab Release Tools Bot2019-10-252-0/+34
|\ | | | | | | | | Mask Sentry auth token See merge request gitlab/gitlabhq!3504
| * Mask Sentry auth tokenRyan Cobb2019-10-242-0/+34
| | | | | | | | | | This makes it so we mask Sentry's auth token. This mask only occurs in the UI.
* | Merge branch 'security-remove-leaky-401-responses-12.4' into '12-4-stable'GitLab Release Tools Bot2019-10-2510-15/+32
|\ \ | | | | | | | | | | | | Private/internal repository enumeration via bruteforce on a vulnerable URL See merge request gitlab/gitlabhq!3491
| * | Avoid #authenticate_user! in #route_not_foundKerri Miller2019-10-2210-15/+32
| |/ | | | | | | | | | | | | | | | | | | | | This method, #route_not_found, is executed as the final fallback for unrecognized routes (as the name might imply.) We want to avoid `#authenticate_user!` when calling `#route_not_found`; `#authenticate_user!` can, depending on the request format, return a 401 instead of redirecting to a login page. This opens a subtle security exploit where anonymous users will receive a 401 response when attempting to access a private repo, while a recognized user will receive a 404, exposing the existence of the private, hidden repo.
* | Return 404 on LFS request if project doesn't existIgor Drozdov2019-10-251-1/+42
| |
* | Merge branch 'security-bvl-validate-force-remove-branch-on-mrs-12-4-ce' into ↵GitLab Release Tools Bot2019-10-246-6/+133
|\ \ | | | | | | | | | | | | | | | | | | '12-4-stable' Only assign merge params when allowed See merge request gitlab/gitlabhq!3487
| * | Only assign merge params when allowedBob Van Landuyt2019-10-236-6/+133
| |/ | | | | | | | | | | | | | | | | When a user updates a merge request coming from a fork, they should not be able to set `force_remove_source_branch` if they cannot push code to the source project. Otherwise developers of the target project could remove the source branch of the source project by setting this flag through the API.
* | Merge branch 'security-wiki-rdoc-content-12-4-ce' into '12-4-stable'GitLab Release Tools Bot2019-10-242-34/+61
|\ \ | | | | | | | | | | | | Pass all wiki markup formats through our Banzai pipeline filters See merge request gitlab/gitlabhq!3485
| * | Pass all wiki markup formats through pipelinesLuke Duncalfe2019-10-232-34/+61
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, when the wiki page format was anything other than `markdown` or `asciidoc` the formatted content would be returned though a Gitaly call. Gitaly in turn would delegate formatting to the gitlab-gollum-lib gem, which in turn would delegate that to various gems (like RDoc for `rdoc`) and then apply some very liberal sanitization. It was too liberal! This change brings our wiki content formatting in line with how we format other markdown at GitLab, so we have a SSOT for sanitization. https://gitlab.com/gitlab-org/gitlab/issues/30540
* | Merge branch 'security-developer-transfer-project-12-4' into '12-4-stable'GitLab Release Tools Bot2019-10-244-1/+118
|\ \ | | | | | | | | | | | | Require Maintainer permission on group where project is transferred to See merge request gitlab/gitlabhq!3486
| * | Require maintainer permission to transfer projectsmanojmj2019-10-234-1/+118
| |/
* | Merge branch 'security-open-redirect-internalredirect-12-4' into '12-4-stable'GitLab Release Tools Bot2019-10-241-1/+2
|\ \ | | | | | | | | | | | | Use the '\A' and '\z' regex anchors in `InternalRedirect` to mitigate an Open Redirect issue. See merge request gitlab/gitlabhq!3488
| * | Use the '\A' and '\z' regex anchors in `InternalRedirect` to mitigate an ↵Joern Schneeweisz2019-10-221-1/+2
| |/ | | | | | | | | | | Open Redirect issue. Fixes https://dev.gitlab.org/gitlab/gitlabhq/issues/2934 and https://gitlab.com/gitlab-org/gitlab/issues/33569
* | Merge branch ↵GitLab Release Tools Bot2019-10-242-2/+85
|\ \ | | | | | | | | | | | | | | | | | | 'security-2914-labels-visible-despite-no-access-to-issues-repositories-12-4' into '12-4-stable' Labels visible despite no access to issues & repositories See merge request gitlab/gitlabhq!3489
| * | Fix labels finder to filter issuablesEugenia Grieff2019-10-222-2/+85
| |/ | | | | | | Use project scopes to filter project labels that are visible for user
* | Merge branch 'security-2920-fix-notes-with-label-cross-reference-12-4' into ↵GitLab Release Tools Bot2019-10-241-0/+57
|\ \ | | | | | | | | | | | | | | | | | | '12-4-stable' Project path reveals labels from Private project if the issue is moved to public project See merge request gitlab/gitlabhq!3490
| * | Add milestone and label note types to cross refsEugenia Grieff2019-10-241-0/+57
| |/ | | | | | | | | | | - Include new types in SystemNoteMetadata - Add Label and Milestone reference_pattern to Mentionable::ReferenceRegexes to be checked for cross references
* | Merge branch 'security-64519-circular-graphql-queries-12-4' into '12-4-stable'GitLab Release Tools Bot2019-10-245-7/+182
|\ \ | | | | | | | | | | | | Nested GraphQL query with circular relationship can cause Denial of Service See merge request gitlab/gitlabhq!3492
| * | Tweak test to insulate against magic number changescharlieablett2019-10-231-0/+1
| | |
| * | Allow tests to ignore recursioncharlieablett2019-10-231-0/+5
| | |
| * | Check for recursion and fail if too recursivecharlieablett2019-10-235-7/+176
| |/ | | | | | | | | | | | | | | | | | | - List all overly-recursive fields - Reduce recursion threshold to 2 - Add test for not-recursive-enough query - Use reusable methods in tests - Add changelog - Set changeable acceptable recursion level - Add error check test helpers
* | Merge branch 'security-33689-post-filter-search-results-ce-12-4' into ↵GitLab Release Tools Bot2019-10-243-7/+29
|\ \ | | | | | | | | | | | | | | | | | | '12-4-stable' Filter out search results based on permissions to avoid bugs leaking data See merge request gitlab/gitlabhq!3496
| * | Add #to_ability_name to Project & MilestoneDylan Griffith2019-10-232-0/+16
| | | | | | | | | | | | This will be used later for search filtering.
| * | Change Note#to_ability_name to 'note'Dylan Griffith2019-10-231-7/+13
| |/ | | | | | | | | | | This is to be more consistent as there is already a :read_note policy in NotePolicy. To keep other behaviour the same we've introduced a Note#noteable_ability_name that is used anywhere this was expected.
* | Merge branch ↵GitLab Release Tools Bot2019-10-241-12/+36
|\ \ | | | | | | | | | | | | | | | | | | 'security-65756-ex-admin-attacker-can-comment-in-internalsecurity-65756-ex-admin-attacker-can-comment-in-internal-12-4' into '12-4-stable' Improper access control allows the attacker to comment in internal commit after they are no longer admin See merge request gitlab/gitlabhq!3497
| * | Users without commit access cannot create notescharlieablett2019-10-231-12/+36
| |/
* | Pick only those groups that the viewing user has access to,Aakriti Gupta2019-10-242-16/+123
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | in a project members' list. Add tests for possible scenarios Re-factor and remove N + 1 queries Remove author from changelog Don't use memoisation when not needed Include users part of parents of project's group Re-factor tests Create and add users according to roles Re-use group created earlier Add incomplete test for ancestoral groups Rename method to clarify category of groups Skip pending test, remove comments not needed Remove extra line Include ancestors from invited groups as well Add specs for participants service Add more specs Add more specs use instead of Use public group owner instead of project maintainer to test owner acess Remove tests that have now been moved into participants_service_spec Use :context instead of :all Create nested group instead of creating an ancestor separately Add comment explaining doubt on the failing spec Imrpove test setup Optimize sql queries Refactor specs file Add rubocop disablement Add special case for project owners Add small refactor Add explanation to the docs Fix wording Refactor group check Add small changes in specs Add cr remarks Add cr remarks Add specs Add small refactor Add code review remarks Refactor for better database usage Fix failing spec Remove rubocop offences Add cr remarks
* Add latest changes from gitlab-org/gitlab@12-4-stable-eeGitLab Bot2019-10-221288-9397/+39381
|
* Merge branch '33216-quarantine-ECDSA' into 'master'Rémy Coutable2019-10-022-2/+2
| | | | | Quarantine some ECDSA related tests due to bumping openssl See merge request gitlab-org/gitlab!18016
* EE port: Fix private feature Elasticsearch leakMark Chao2019-10-014-0/+197
| | | | | | Add spec to test different combinations. Accept string for required_minimum_access_level Allow more flexible project membership query
* Merge branch 'fix_expired_gpg_key_specs' into 'master'Stan Hu2019-09-302-151/+270
| | | | | | | Fix broken specs : Generate new GPG key in place of expired one Closes #32956 See merge request gitlab-org/gitlab!17853
* Merge branch 'security-bypass-email-verification-using-salesforce' into ↵GitLab Release Tools Bot2019-09-263-25/+55
|\ | | | | | | | | | | | | '12-3-stable' Prevent Bypassing Email Verification using Salesforce See merge request gitlab/gitlabhq!3395
| * Add checking for email_verified keyMałgorzata Ksionek2019-09-233-25/+55
| | | | | | | | | | | | | | | | | | | | | | | | Fix rubocop offences and add changelog Add email_verified key for feature specs Add code review remarks Add code review remarks Fix specs
* | Merge branch 'security-sarcila-verify-saml-request-origin-12-3' into ↵GitLab Release Tools Bot2019-09-265-36/+191
|\ \ | | | | | | | | | | | | | | | | | | '12-3-stable' Check that SAML identity linking validates the origin of the request See merge request gitlab/gitlabhq!3396
| * | Validate that SAML requests are originated from gitlabSebastian Arcila Valenzuela2019-09-205-36/+191
| |/ | | | | | | | | | | | | | | If the request wasn't initiated by gitlab we shouldn't add the new identity to the user, and instead show that we weren't able to link the identity to the user. This should fix: https://gitlab.com/gitlab-org/gitlab-ce/issues/56509
* | Merge branch 'security-mermaid-block' into '12-3-stable'GitLab Release Tools Bot2019-09-261-0/+39
|\ \ | | | | | | | | | | | | Only render fixed number of mermaid blocks See merge request gitlab/gitlabhq!3411
| * | Only render fixed number of mermaid blocksRajat Jain2019-09-131-0/+39
| | |
* | | Merge branch ↵GitLab Release Tools Bot2019-09-261-0/+41
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | 'security-12717-fix-confidential-issue-assignee-visible-to-guests-12-3' into '12-3-stable' Display only participants that user has permission to see See merge request gitlab/gitlabhq!3421
| * | | Display only participants that user has permission to seeAlexandru Croitor2019-09-231-0/+41
| | |/ | |/|
* | | Merge branch 'security-64938-dont-disclose-path-12-3-ce' into '12-3-stable'GitLab Release Tools Bot2019-09-261-0/+29
|\ \ \ | | | | | | | | | | | | | | | | Redirect user to root path after unsubscribing from private resource See merge request gitlab/gitlabhq!3423
| * | | Redirect user to root path after unsubscribing from private resourceAlexandru Croitor2019-09-231-0/+29
| |/ / | | | | | | | | | | | | | | | | | | | | | If user unsubsrcribes from a resource that they no longer have access to they should not be revealed the resource path, but be redirected to app root instead. https://gitlab.com/gitlab-org/gitlab-ce/issues/64938
* | | Merge branch ↵GitLab Release Tools Bot2019-09-262-2/+101
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | 'security-12718-project-milestones-disclosed-via-groups-12-3-ce' into '12-3-stable' Hide disabled project milestones in project settings on group level See merge request gitlab/gitlabhq!3424
| * | | Hide disabled project milestones in project settings on group levelAlexandru Croitor2019-09-232-2/+101
| |/ /
* | | Merge branch ↵GitLab Release Tools Bot2019-09-262-0/+162
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | 'security-12630-private-system-note-disclosed-in-graphql-12-3-ce' into '12-3-stable' Add policy check if cross reference system notes are accessible See merge request gitlab/gitlabhq!3426
| * | | Add policy check if cross reference system notes are accessibleAlexandru Croitor2019-09-232-0/+162
| |/ /
* | | Merge branch 'security-fp-stop-jobs-when-blocking-user-12-3' into '12-3-stable'GitLab Release Tools Bot2019-09-262-1/+40
|\ \ \ | | | | | | | | | | | | | | | | Cancel all running CI jobs when user is blocked See merge request gitlab/gitlabhq!3436
| * | | Cancel all running CI jobs when user is blockedFabio Pitino2019-09-242-1/+40
| |/ / | | | | | | | | | | | | | | | This prevents a MITM attack where attacker could still access Git repository if any jobs were running long enough.
* | | Filter not accessible label eventsJan Provaznik2019-09-244-30/+208
| | | | | | | | | | | | | | | | | | Label events may use cross-project or cross-group references, if the projects are not accessible by user, we don't show these label events.
* | | Add latest changes from gitlab-org/gitlab@12-3-stable-eeGitLab Bot2019-09-244-54/+64
|/ /
View Lorry Controller Status