Read about our upcoming Code of Conduct on this issue

  1. 27 Jan, 2020 1 commit
  2. 13 Jan, 2020 2 commits
  3. 20 Dec, 2019 1 commit
  4. 16 Dec, 2019 1 commit
  5. 11 Dec, 2019 1 commit
  6. 02 Dec, 2019 1 commit
  7. 01 Dec, 2019 1 commit
  8. 26 Nov, 2019 2 commits
    • Arturo Herrero's avatar
      Encrypt application settings with pre and post deployments · 9065c75055d4
      Arturo Herrero authored
      We had concerns about the cached values on Redis with the previous two
      releases strategy:
      
      First release (this commit):
        - Create new encrypted fields in the database.
        - Start populating new encrypted fields, read the encrypted fields or
          fallback to the plaintext fields.
        - Backfill the data removing the plaintext fields to the encrypted
          fields.
      Second release:
        - Remove the virtual attribute (created in step 2).
        - Drop plaintext columns from the database (empty columns after
          step 3).
      
      We end up with a better strategy only using migration scripts in one
      release:
        - Pre-deployment migration: Add columns required for storing encrypted
          values.
        - Pre-deployment migration: Store the encrypted values in the new
          columns.
        - Post-deployment migration: Remove the old unencrypted columns
      9065c75055d4
    • Arturo Herrero's avatar
      Encrypt application setting tokens · e98ef692edd1
      Arturo Herrero authored
      This is the plan to encrypt the plaintext tokens:
      
      First release (this commit):
        1. Create new encrypted fields in the database.
        2. Start populating new encrypted fields, read the encrypted fields or
           fallback to the plaintext fields.
        3. Backfill the data removing the plaintext fields to the encrypted fields.
      
      Second release:
        4. Remove the virtual attribute (created in step 2).
        5. Drop plaintext columns from the database (empty columns after step 3).
      e98ef692edd1
  9. 15 Nov, 2019 1 commit
  10. 13 Nov, 2019 1 commit
  11. 12 Nov, 2019 1 commit
  12. 08 Nov, 2019 1 commit
  13. 04 Nov, 2019 1 commit
  14. 31 Oct, 2019 1 commit
  15. 22 Oct, 2019 1 commit
  16. 17 Oct, 2019 1 commit
  17. 16 Oct, 2019 1 commit
  18. 26 Sep, 2019 1 commit
  19. 13 Sep, 2019 1 commit
  20. 10 Sep, 2019 2 commits
  21. 30 Aug, 2019 1 commit
  22. 29 Aug, 2019 1 commit
  23. 24 Aug, 2019 1 commit
  24. 14 Aug, 2019 1 commit
  25. 07 Aug, 2019 1 commit
  26. 31 Jul, 2019 2 commits
    • Małgorzata Ksionek's avatar
      Add captcha if there are multiple failed login attempts · 7005864a768e
      Małgorzata Ksionek authored
      Add method to store session ids by ip
      
      Add new specs for storing session ids
      
      Add cleaning up records after login
      
      Add retrieving anonymous sessions
      
      Add login recaptcha setting
      
      Add new setting to sessions controller
      
      Add conditions for showing captcha
      
      Add sessions controller specs
      
      Add admin settings specs for login protection
      
      Add new settings to api
      
      Add stub to devise spec
      
      Add new translation key
      
      Add cr remarks
      
      Rename class call
      
      Add cr remarks
      
      Change if-clause for consistency
      
      Add cr remarks
      
      Add code review remarks
      
      Refactor AnonymousSession class
      
      Add changelog entry
      
      Move AnonymousSession class to lib
      
      Move store unauthenticated sessions to sessions controller
      
      Move link to recaptcha info
      
      Regenerate text file
      
      Improve copy on the spam page
      
      Change action filter for storing anonymous sessions
      
      Fix rubocop offences
      
      Add code review remarks
      7005864a768e
    • Reuben Pereira's avatar
      Allow blank but not nil in validations · dcff720b0310
      Reuben Pereira authored
      - The most common use case for qualified_domain_validator currently is
      to allow blank ([]) but not allow nil. Modify the
      qualified_domain_validator to support this use case.
      dcff720b0310
  27. 24 Jul, 2019 1 commit
  28. 02 Jul, 2019 1 commit
    • Stan Hu's avatar
      Add a memory cache local to the thread to reduce Redis load · 13403d840eb0
      Stan Hu authored
      Loading `ApplicationSetting` from Redis was responsible for at least 50%
      of the CPU load of the Redis cluster on GitLab.com. Since these values
      generally don't change very much, we can load this from the database and
      cache it in memory, skipping Redis altogther. We use
      `ActiveSupport::Cache::MemoryStore` as a drop-in replacement for
      `RedisCacheStore` even though we probably don't need synchronized access
      within `Thread.current`.
      
      Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/63977
      13403d840eb0
  29. 28 Jun, 2019 1 commit
  30. 25 Jun, 2019 1 commit
  31. 28 May, 2019 1 commit
    • Vladimir Shushlin's avatar
      Store Let's Encrypt private key in settings · 54cadc2f8ada
      Vladimir Shushlin authored
      Storing this key in secrets.yml was a bad idea,
      it would require users using HA setups to manually
      replicate secrets across nodes during update,
      it also needed support from omnibus package
      
      * Revert "Generate Let's Encrypt private key"
        This reverts commit 444959bfa0b79e827a2a1a7a314acac19390f976.
      
      * Add Let's Encrypt private key to settings
        as encrypted attribute
      
      * Generate Let's Encrypt private key
        in database migration
      54cadc2f8ada
  32. 27 Apr, 2019 1 commit
  33. 12 Apr, 2019 1 commit
  34. 11 Apr, 2019 1 commit
    • Thong Kuah's avatar
      Align UrlValidator to validate_url gem implementation. · 77da24aaafd6
      Thong Kuah authored
      Renamed UrlValidator to AddressableUrlValidator to avoid 'url:' naming collision with ActiveModel::Validations::UrlValidator in 'validates' statement.
      Make use of the options attribute of the parent class ActiveModel::EachValidator.
      Add more options: allow_nil, allow_blank, message.
      Renamed 'protocols' option to 'schemes' to match the option naming from UrlValidator.
      77da24aaafd6
  35. 10 Apr, 2019 1 commit
    • Rémy Coutable's avatar
      Fix ApplicationSetting development seed · 156637f55bac
      Rémy Coutable authored
      
      
      It could happen that there's a cached (in Redis) ApplicationSetting
      record, and calling
      `Gitlab::CurrentSettings.current_application_settings` only returns it
      instead of creating a new DB record, which makes the
      `ApplicationSetting.current_without_cache.update!` call fail.
      Signed-off-by: default avatarRémy Coutable <remy@rymai.me>
      156637f55bac
  36. 09 Apr, 2019 1 commit