1. 30 Jun, 2016 1 commit
  2. 29 Jun, 2016 9 commits
  3. 28 Jun, 2016 4 commits
  4. 27 Jun, 2016 5 commits
  5. 26 Jun, 2016 1 commit
  6. 24 Jun, 2016 4 commits
    • Felipe Artur's avatar
    • Phil Hughes's avatar
      Fixed URL on label button when filtering · 8589d7cbaee5
      Phil Hughes authored
      Closes #19005
    • Rémy Coutable's avatar
      Fix an information disclosure when requesting access to a group containing private projects · 24ee7c9ecfb4
      Rémy Coutable authored
      The issue was with the `User#groups` and `User#projects` associations
      which goes through the `User#group_members` and `User#project_members`.
      Initially I chose to use a secure approach by storing the requester's
      user ID in `Member#created_by_id` instead of `Member#user_id` because I
      was aware that there was a security risk since I didn't know the
      codebase well enough.
      Then during the review, we decided to change that and directly store the
      requester's user ID into `Member#user_id` (for the sake of simplifying
      the code I believe), meaning that every `group_members` / `project_members`
      association would include the requesters by default...
      My bad for not checking that all the `group_members` / `project_members`
      associations and the ones that go through them (e.g. `Group#users` and
      `Project#users`) were made safe with the `where(requested_at: nil)` /
      `where(members: { requested_at: nil })` scopes.
      Now they are all secure.
      Signed-off-by: default avatarRémy Coutable <remy@rymai.me>
    • Yorick Peterse's avatar
      Support for rendering/redacting multiple documents · 8c4e1063826d
      Yorick Peterse authored
      This commit changes the way certain documents are rendered (currently
      only Notes) and how documents are redacted. Previously both rendering
      and redacting would run on a per document basis. The result of this was
      that for every document we'd have to run countless queries just to
      figure out if we could display a set of links or not.
      This commit changes things around so that redacting Markdown documents
      is no longer tied into the html-pipeline Gem. This in turn allows it to
      redact multiple documents in a single pass, thus reducing the number of
      queries needed.
      In turn rendering issue/merge request notes has been adjusted to take
      advantage of this new setup. Instead of rendering Markdown somewhere
      deep down in a view the Markdown is rendered and redacted in the
      controller (taking the current user and all that into account). This has
      been done in such a way that the "markdown()" helper method can still be
      used on its own.
      This particular commit also paves the way for caching rendered HTML on
      object level. Right now there's an accessor method Note#note_html which
      is used for setting/getting the rendered HTML. Once we cache HTML on row
      level we can simply change this field to be a column and call a "save"
      whenever needed and we're pretty much done.
  7. 23 Jun, 2016 9 commits
  8. 22 Jun, 2016 6 commits
  9. 21 Jun, 2016 1 commit