Skip to content
GitLab
Menu
Projects
Groups
Snippets
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
heptapod
heptapod
Commits
34ce77451e2b
Commit
149b0979
authored
Mar 31, 2021
by
GitLab Release Tools Bot
Browse files
Merge remote-tracking branch 'dev/13-10-stable' into 13-10-stable
parents
0f15d4a145fd
9fc05e9c6cbd
Changes
28
Hide whitespace changes
Inline
Side-by-side
CHANGELOG.md
View file @
34ce7745
...
...
@@ -2,6 +2,28 @@
documentation
](
doc/development/changelog.md
)
for instructions on adding your own
entry.
## 13.10.1 (2021-03-31)
### Security (6 changes)
-
Leave pool repository on fork unlinking.
-
Fixed XSS in merge requests sidebar.
-
Fix arbitrary read/write in AsciiDoctor and Kroki gems.
-
Prevent infinite loop when checking if collaboration is allowed.
-
Disable arbitrary URI and file reads in JSON validator.
-
Require POST request to trigger system hooks.
### Removed (1 change)
-
Make HipChat project service do nothing. !57434
### Other (3 changes)
-
Remove direct mimemagic dependency. !57387
-
Refactor MimeMagic calls to new MimeType class. !57421
-
Switch to using a fake mimemagic gem. !57443
## 13.10.0 (2021-03-22)
### Security (3 changes)
...
...
GITALY_SERVER_VERSION
View file @
34ce7745
13.10.0
\ No newline at end of file
13.10.1
\ No newline at end of file
VERSION
View file @
34ce7745
13.10.0
\ No newline at end of file
13.10.1
\ No newline at end of file
app/models/merge_request.rb
View file @
34ce7745
...
...
@@ -1337,8 +1337,8 @@ def broken?
has_no_commits?
||
branch_missing?
||
cannot_be_merged?
end
def
can_be_merged_by?
(
user
)
access
=
::
Gitlab
::
UserAccess
.
new
(
user
,
container:
project
)
def
can_be_merged_by?
(
user
,
skip_collaboration_check:
false
)
access
=
::
Gitlab
::
UserAccess
.
new
(
user
,
container:
project
,
skip_collaboration_check:
skip_collaboration_check
)
access
.
can_update_branch?
(
target_branch
)
end
...
...
app/models/project.rb
View file @
34ce7745
...
...
@@ -2704,7 +2704,7 @@ def fetch_branch_allows_collaboration(user, branch_name = nil)
# Issue for N+1: https://gitlab.com/gitlab-org/gitlab-foss/issues/49322
Gitlab
::
GitalyClient
.
allow_n_plus_1_calls
do
merge_requests_allowing_collaboration
(
branch_name
).
any?
do
|
merge_request
|
merge_request
.
can_be_merged_by?
(
user
)
merge_request
.
can_be_merged_by?
(
user
,
skip_collaboration_check:
true
)
end
end
end
...
...
app/services/projects/unlink_fork_service.rb
View file @
34ce7745
...
...
@@ -32,6 +32,8 @@ def execute
if
fork_network
=
@project
.
root_of_fork_network
fork_network
.
update
(
root_project:
nil
,
deleted_root_project_name:
@project
.
full_name
)
end
@project
.
leave_pool_repository
end
# rubocop: disable Cop/InBatches
...
...
app/views/shared/issuable/_sidebar.html.haml
View file @
34ce7745
...
...
@@ -138,7 +138,7 @@
=
clipboard_button
(
text:
source_branch
,
title:
_
(
'Copy branch name'
),
placement:
"left"
,
boundary:
'viewport'
)
.sidebar-mr-source-branch.hide-collapsed
%span
=
_
(
'Source branch: %{source_branch_open}%{source_branch}%{source_branch_close}'
).
html_safe
%
{
source_branch_open:
"<cite class='ref-name' title='
#{
source_branch
}
'>"
.
html_safe
,
source_branch_close:
"</cite>"
.
html_safe
,
source_branch:
source_branch
}
=
_
(
'Source branch: %{source_branch_open}%{source_branch}%{source_branch_close}'
).
html_safe
%
{
source_branch_open:
"<cite class='ref-name' title='
#{
html_escape
(
source_branch
)
}
'>"
.
html_safe
,
source_branch_close:
"</cite>"
.
html_safe
,
source_branch:
html_escape
(
source_branch
)
}
=
clipboard_button
(
text:
source_branch
,
title:
_
(
'Copy branch name'
),
placement:
"left"
,
boundary:
'viewport'
)
-
if
show_forwarding_email
...
...
changelogs/unreleased/mimemagic_shim.yml
deleted
100644 → 0
View file @
0f15d4a1
---
title
:
Switch to using a fake mimemagic gem
merge_request
:
57443
author
:
type
:
other
changelogs/unreleased/remove-direct-mimemagic-dependency-minimal.yml
deleted
100644 → 0
View file @
0f15d4a1
---
title
:
Refactor MimeMagic calls to new MimeType class
merge_request
:
57421
author
:
type
:
other
changelogs/unreleased/remove-direct-mimemagic-dependency.yml
deleted
100644 → 0
View file @
0f15d4a1
---
title
:
Remove direct mimemagic dependency
merge_request
:
57387
author
:
type
:
other
changelogs/unreleased/remove_hipchat_gem.yml
deleted
100644 → 0
View file @
0f15d4a1
---
title
:
Make HipChat project service do nothing
merge_request
:
57434
author
:
type
:
removed
config/initializers/asciidoctor_patch.rb
0 → 100644
View file @
34ce7745
# frozen_string_literal: true
# Ensure that locked attributes can not be changed using a counter.
# TODO: this can be removed once `asciidoctor` gem is > 2.0.12
# and https://github.com/asciidoctor/asciidoctor/issues/3939 is merged
module
Asciidoctor
module
DocumentPatch
def
counter
(
name
,
seed
=
nil
)
return
@parent_document
.
counter
(
name
,
seed
)
if
@parent_document
# rubocop: disable Gitlab/ModuleWithInstanceVariables
unless
attribute_locked?
name
super
end
end
end
end
class
Asciidoctor::Document
prepend
Asciidoctor
::
DocumentPatch
end
config/initializers/json_validator_patch.rb
0 → 100644
View file @
34ce7745
# frozen_string_literal: true
# This patches https://github.com/ruby-json-schema/json-schema/blob/765e6d8fdbfdaca1a42fa743f4621e757f9f6a03/lib/json-schema/validator.rb
# to address https://github.com/ruby-json-schema/json-schema/issues/148.
require
'json-schema'
module
JSON
class
Validator
def
initialize_data
(
data
)
if
@options
[
:parse_data
]
if
@options
[
:json
]
data
=
self
.
class
.
parse
(
data
)
elsif
@options
[
:uri
]
json_uri
=
Util
::
URI
.
normalized_uri
(
data
)
data
=
self
.
class
.
parse
(
custom_open
(
json_uri
))
elsif
data
.
is_a?
(
String
)
begin
data
=
self
.
class
.
parse
(
data
)
rescue
JSON
::
Schema
::
JsonParseError
# Silently discard the error - use the data as-is
end
end
end
JSON
::
Schema
.
stringify
(
data
)
end
end
end
doc/api/system_hooks.md
View file @
34ce7745
...
...
@@ -88,7 +88,7 @@ Example response:
## Test system hook
```
plaintext
GE
T /hooks/:id
POS
T /hooks/:id
```
| Attribute | Type | Required | Description |
...
...
@@ -98,7 +98,7 @@ GET /hooks/:id
Example request:
```
shell
curl
--header
"PRIVATE-TOKEN: <your_access_token>"
"https://gitlab.example.com/api/v4/hooks/
2
"
curl
--request
POST
--header
"PRIVATE-TOKEN: <your_access_token>"
"https://gitlab.example.com/api/v4/hooks/
1
"
```
Example response:
...
...
lib/api/system_hooks.rb
View file @
34ce7745
...
...
@@ -47,7 +47,7 @@ class SystemHooks < ::API::Base
params
do
requires
:id
,
type:
Integer
,
desc:
'The ID of the system hook'
end
ge
t
":id"
do
pos
t
":id"
do
hook
=
SystemHook
.
find
(
params
[
:id
])
data
=
{
event_name:
"project_create"
,
...
...
lib/gitlab/markdown_cache.rb
View file @
34ce7745
...
...
@@ -3,7 +3,7 @@
module
Gitlab
module
MarkdownCache
# Increment this number every time the renderer changes its output
CACHE_COMMONMARK_VERSION
=
2
6
CACHE_COMMONMARK_VERSION
=
2
7
CACHE_COMMONMARK_VERSION_START
=
10
BaseError
=
Class
.
new
(
StandardError
)
...
...
lib/gitlab/user_access.rb
View file @
34ce7745
...
...
@@ -11,10 +11,11 @@ class UserAccess
attr_reader
:user
,
:push_ability
attr_accessor
:container
def
initialize
(
user
,
container:
nil
,
push_ability: :push_code
)
def
initialize
(
user
,
container:
nil
,
push_ability: :push_code
,
skip_collaboration_check:
false
)
@user
=
user
@container
=
container
@push_ability
=
push_ability
@skip_collaboration_check
=
skip_collaboration_check
end
def
can_do_action?
(
action
)
...
...
@@ -87,6 +88,8 @@ def can_push_for_ref?(_)
private
attr_reader
:skip_collaboration_check
def
can_push?
user
.
can?
(
push_ability
,
container
)
end
...
...
@@ -98,6 +101,8 @@ def can_collaborate?(ref)
end
def
branch_allows_collaboration_for?
(
ref
)
return
false
if
skip_collaboration_check
# Checking for an internal project or group to prevent an infinite loop:
# https://gitlab.com/gitlab-org/gitlab/issues/36805
(
!
project
.
internal?
&&
project
.
branch_allows_collaboration?
(
user
,
ref
))
...
...
spec/factories/pool_repositories.rb
View file @
34ce7745
...
...
@@ -6,7 +6,7 @@
state
{
:none
}
before
(
:create
)
do
|
pool
|
pool
.
source_project
=
create
(
:project
,
:repository
)
pool
.
source_project
||
=
create
(
:project
,
:repository
)
pool
.
source_project
.
update!
(
pool_repository:
pool
)
end
...
...
spec/features/merge_request/user_views_open_merge_request_spec.rb
View file @
34ce7745
...
...
@@ -111,4 +111,21 @@
end
end
end
context
'XSS source branch'
do
let
(
:project
)
{
create
(
:project
,
:public
,
:repository
)
}
let
(
:source_branch
)
{
"'><iframe/srcdoc=''></iframe>"
}
before
do
project
.
repository
.
create_branch
(
source_branch
,
"master"
)
mr
=
create
(
:merge_request
,
source_project:
project
,
target_project:
project
,
source_branch:
source_branch
)
visit
(
merge_request_path
(
mr
))
end
it
'encodes branch name'
do
expect
(
find
(
'cite.ref-name'
)[
:title
]).
to
eq
(
source_branch
)
end
end
end
spec/initializers/json_validator_patch_spec.rb
0 → 100644
View file @
34ce7745
# frozen_string_literal: true
require
'spec_helper'
require
'rspec-parameterized'
RSpec
.
describe
'JSON validator patch'
do
using
RSpec
::
Parameterized
::
TableSyntax
let
(
:schema
)
{
'{"format": "string"}'
}
subject
{
JSON
::
Validator
.
validate
(
schema
,
data
)
}
context
'with invalid JSON'
do
where
(
:data
)
do
[
'https://example.com'
,
'/tmp/test.txt'
]
end
with_them
do
it
'does not attempt to open a file or URI'
do
allow
(
File
).
to
receive
(
:read
).
and_call_original
allow
(
URI
).
to
receive
(
:open
).
and_call_original
expect
(
File
).
not_to
receive
(
:read
).
with
(
data
)
expect
(
URI
).
not_to
receive
(
:open
).
with
(
data
)
expect
(
subject
).
to
be
true
end
end
end
context
'with valid JSON'
do
let
(
:data
)
{
%({ 'somekey': 'value' })
}
it
'validates successfully'
do
expect
(
subject
).
to
be
true
end
end
end
Prev
1
2
Next
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment