Read about our upcoming Code of Conduct on this issue

  1. 24 Oct, 2016 1 commit
  2. 11 Oct, 2016 1 commit
  3. 07 Oct, 2016 1 commit
  4. 05 Oct, 2016 1 commit
    • Yorick Peterse's avatar
      Refactor Gitlab::Identifier · f22b88d412ae
      Yorick Peterse authored
      This refactors Gitlab::Identifier so it uses fewer queries and is
      actually tested. Queries are reduced by caching the output as well as
      using 1 query (instead of 2) to find a user using an SSH key.
  5. 04 Oct, 2016 1 commit
    • Sean McGivern's avatar
      Restrict failed login attempts for users with 2FA · f2605d70c39e
      Sean McGivern authored
      Copy logic from `Devise::Models::Lockable#valid_for_authentication?`, as
      our custom login flow with two pages doesn't call this method. This will
      increment the failed login counter, and lock the user's account once
      they exceed the number of failed attempts.
      Also ensure that users who are locked can't continue to submit 2FA
  6. 15 Sep, 2016 2 commits
  7. 01 Sep, 2016 1 commit
  8. 30 Aug, 2016 1 commit
  9. 24 Aug, 2016 1 commit
  10. 17 Aug, 2016 1 commit
  11. 12 Aug, 2016 1 commit
  12. 04 Aug, 2016 1 commit
  13. 03 Aug, 2016 1 commit
    • Sean McGivern's avatar
      Store OTP secret key in secrets.yml · ac2221b2b021
      Sean McGivern authored
      .secret stores the secret token used for both encrypting login cookies
      and for encrypting stored OTP secrets. We can't rotate this, because
      that would invalidate all existing OTP secrets.
      If the secret token is present in the .secret file or an environment
      variable, save it as otp_key_base in secrets.yml. Now .secret can be
      rotated without invalidating OTP secrets.
      If the secret token isn't present (initial setup), then just generate a
      separate otp_key_base and save in secrets.yml.
      Update the docs to reflect that secrets.yml needs to be retained past
      upgrades, but .secret doesn't.
  14. 01 Aug, 2016 1 commit
  15. 20 Jul, 2016 1 commit
  16. 19 Jul, 2016 1 commit
  17. 18 Jul, 2016 5 commits
  18. 15 Jul, 2016 1 commit
  19. 12 Jul, 2016 1 commit
  20. 07 Jul, 2016 1 commit
    • Dravere's avatar
      Added setting to set new users by default as external · 7b67f0aa7bda
      Dravere authored
      As requested by the issue #14508 this adds an option in the application
      settings to set newly registered users by default as external. The
      default setting is set to false to stay backward compatible.
  21. 05 Jul, 2016 1 commit
  22. 01 Jul, 2016 1 commit
  23. 29 Jun, 2016 1 commit
  24. 28 Jun, 2016 1 commit
  25. 24 Jun, 2016 1 commit
    • Rémy Coutable's avatar
      Fix an information disclosure when requesting access to a group containing private projects · 24ee7c9ecfb4
      Rémy Coutable authored
      The issue was with the `User#groups` and `User#projects` associations
      which goes through the `User#group_members` and `User#project_members`.
      Initially I chose to use a secure approach by storing the requester's
      user ID in `Member#created_by_id` instead of `Member#user_id` because I
      was aware that there was a security risk since I didn't know the
      codebase well enough.
      Then during the review, we decided to change that and directly store the
      requester's user ID into `Member#user_id` (for the sake of simplifying
      the code I believe), meaning that every `group_members` / `project_members`
      association would include the requesters by default...
      My bad for not checking that all the `group_members` / `project_members`
      associations and the ones that go through them (e.g. `Group#users` and
      `Project#users`) were made safe with the `where(requested_at: nil)` /
      `where(members: { requested_at: nil })` scopes.
      Now they are all secure.
      Signed-off-by: default avatarRémy Coutable <>
  26. 23 Jun, 2016 1 commit
  27. 20 Jun, 2016 1 commit
  28. 17 Jun, 2016 1 commit
    • Paco Guzman's avatar
      Cache todo counters (pending/done) · 98b1b692d430
      Paco Guzman authored
      - As todos are created/updated inside the TodoService
      we repopulate the cache just there for both pending/done todos
      - Todos as mark as done from the TodosController we update cache
      there too
      - All the added methods are kept in the User class for cohesion
  29. 16 Jun, 2016 3 commits
    • James Lopez's avatar
      Revert "squashed merge and fixed conflicts" · 91545d127ac6
      James Lopez authored
      This reverts commit 429cd5e57fb1.
    • James Lopez's avatar
      squashed merge and fixed conflicts · 429cd5e57fb1
      James Lopez authored
    • Timothy Andrew's avatar
      Implement @DouweM's feedback. · 90327ddabc32
      Timothy Andrew authored
      - Extract a duplicated `redirect_to`
      - Fix a typo: "token", not "certificate"
      - Have the "Expires at" datepicker be attached to a text field, not inline
      - Have both private tokens and personal access tokens verified in a
        single "authenticate_from_private_token" method, both in the
        application and API. Move relevant logic to
      - Remove unnecessary constants relating to API auth. We don't need a
        separate constant for personal access tokens since the param is the
        same as for private tokens.
  30. 14 Jun, 2016 1 commit
  31. 13 Jun, 2016 2 commits
  32. 10 Jun, 2016 1 commit