From 95ced3bb5fa52e166aa03ee592f63180601cbde7 Mon Sep 17 00:00:00 2001 From: Douwe Maan Date: Tue, 13 Mar 2018 22:38:25 +0000 Subject: Merge branch 'fj-15329-services-callbacks-ssrf' into 'security-10-6' Server Side Request Forgery in Services and Web Hooks See merge request gitlab/gitlabhq!2337 --- app/services/projects/import_service.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'app/services/projects') diff --git a/app/services/projects/import_service.rb b/app/services/projects/import_service.rb index f2d676af5c3..a34024f4f80 100644 --- a/app/services/projects/import_service.rb +++ b/app/services/projects/import_service.rb @@ -28,7 +28,7 @@ module Projects def add_repository_to_project if project.external_import? && !unknown_url? - raise Error, 'Blocked import URL.' if Gitlab::UrlBlocker.blocked_url?(project.import_url) + raise Error, 'Blocked import URL.' if Gitlab::UrlBlocker.blocked_url?(project.import_url, valid_ports: Project::VALID_IMPORT_PORTS) end # We should skip the repository for a GitHub import or GitLab project import, -- cgit v1.2.1