1. 07 Apr, 2018 5 commits
  2. 27 Mar, 2018 1 commit
  3. 28 Feb, 2018 1 commit
  4. 17 Jan, 2018 1 commit
  5. 23 Nov, 2017 2 commits
  6. 08 Nov, 2017 1 commit
  7. 02 Nov, 2017 2 commits
  8. 18 Sep, 2017 1 commit
  9. 01 Sep, 2017 1 commit
  10. 21 Aug, 2017 1 commit
  11. 02 Aug, 2017 2 commits
  12. 27 Jul, 2017 1 commit
  13. 13 Jul, 2017 1 commit
    • Robin Bobbitt's avatar
      Fixes needed when GitLab sign-in is not enabled · 01877dc4c826
      Robin Bobbitt authored
      When sign-in is disabled:
       - skip password expiration checks
       - prevent password reset requests
       - don’t show Password tab in User Settings
       - don’t allow login with username/password for Git over HTTP requests
       - render 404 on requests to Profiles::PasswordsController
      01877dc4c826
  14. 08 Jun, 2017 1 commit
  15. 06 Jun, 2017 1 commit
  16. 05 Jun, 2017 1 commit
    • Z.J. van de Weg's avatar
      Create read_registry scope with JWT auth · 41c7e7a42127
      Z.J. van de Weg authored
      This is the first commit doing mainly 3 things:
      1. create a new scope and allow users to use it
      2. Have the JWTController respond correctly on this
      3. Updates documentation to suggest usage of PATs
      
      There is one gotcha, there will be no support for impersonation tokens, as this
      seems not needed.
      
      Fixes gitlab-org/gitlab-ce#19219
      41c7e7a42127
  17. 10 May, 2017 1 commit
  18. 13 Apr, 2017 1 commit
  19. 07 Mar, 2017 2 commits
  20. 06 Mar, 2017 4 commits
  21. 01 Mar, 2017 1 commit
  22. 28 Feb, 2017 1 commit
  23. 23 Feb, 2017 4 commits
  24. 30 Jan, 2017 1 commit
    • Drew Blessing's avatar
      Reduce hits to LDAP on Git HTTP auth by reordering auth mechanisms · a28cbd735a49
      Drew Blessing authored
      We accept half a dozen different authentication mechanisms for
      Git over HTTP. Fairly high in the list we were checking user
      password, which would also query LDAP. In the case of LFS,
      OAuth tokens or personal access tokens, we were unnecessarily
      hitting LDAP when the authentication will not succeed. This
      was causing some LDAP/AD systems to lock the account. Now,
      user password authentication is the last mechanism tried since
      it's the most expensive.
      a28cbd735a49
  25. 16 Dec, 2016 2 commits
    • Timothy Andrew's avatar
      View-related (and other minor) changes to !5951 based on @rymai's review. · deb4d8d8f608
      Timothy Andrew authored
      - The `scopes_form` partial can be used in the `admin/applications` view
        as well
      
      - Don't allow partials to access instance variables directly. Instead, pass
        in the instance variables as local variables, and use `local_assigns.fetch`
        to assert that the variables are passed in as expected.
      
      - Change a few instances of `render :partial` to `render`
      
      - Remove an instance of `required: false` in a view, since this is the default
      
      - Inline many instances of a local variable (`ip = 'ip'`) in `auth_spec`
      deb4d8d8f608
    • Timothy Andrew's avatar
      Validate access token scopes in `Gitlab::Auth` · 9caa822267e0
      Timothy Andrew authored
      - This module is used for git-over-http, as well as JWT.
      
      - The only valid scope here is `api`, currently.
      9caa822267e0