- 30 Jun, 2016 1 commit
-
-
Alejandro Rodríguez authored
-
- 29 Jun, 2016 9 commits
-
-
Luke "Jared" Bennett authored
Removed from window and used static method
-
Phil Hughes authored
-
Stan Hu authored
In #19273, we saw that retrieving ProjectTeam#human_max_access for each note takes the bulk of the time when rendering certain issues or merge requests. We observe that most of the comments in an issue are typically done by the same users. This MR memoizes the max access level by user ID.
-
Josh Frye authored
-
Josh Frye authored
-
Josh Frye authored
-
Josh Frye authored
-
Josh Frye authored
-
Josh Frye authored
-
- 28 Jun, 2016 4 commits
-
-
Grzegorz Bizon authored
Closes #18949
-
Annabel Dunstone authored
-
winniehell authored
-
Luke "Jared" Bennett authored
Completed new project page Updated CHANGELOG Corrected 'Create project' button Made responsive Added gitlab export button Changed Spinach test to match updated UI reverted test changes and fixed UI Corrected 'Repo by URL' text Fixed static namespace style Added errors partial Added padding to bottom of page-with-sidebar
-
- 27 Jun, 2016 5 commits
-
-
http://jneen.net/ authored
paired with @stanhu
-
Annabel Dunstone authored
-
Annabel Dunstone authored
-
Phil Hughes authored
Closes #19173
-
Connor Shea authored
-
- 26 Jun, 2016 1 commit
-
-
Takuya Noguchi authored
-
- 24 Jun, 2016 4 commits
-
-
Felipe Artur authored
-
Phil Hughes authored
Closes #19005
-
Rémy Coutable authored
The issue was with the `User#groups` and `User#projects` associations which goes through the `User#group_members` and `User#project_members`. Initially I chose to use a secure approach by storing the requester's user ID in `Member#created_by_id` instead of `Member#user_id` because I was aware that there was a security risk since I didn't know the codebase well enough. Then during the review, we decided to change that and directly store the requester's user ID into `Member#user_id` (for the sake of simplifying the code I believe), meaning that every `group_members` / `project_members` association would include the requesters by default... My bad for not checking that all the `group_members` / `project_members` associations and the ones that go through them (e.g. `Group#users` and `Project#users`) were made safe with the `where(requested_at: nil)` / `where(members: { requested_at: nil })` scopes. Now they are all secure. Signed-off-by:
Rémy Coutable <remy@rymai.me>
-
Yorick Peterse authored
This commit changes the way certain documents are rendered (currently only Notes) and how documents are redacted. Previously both rendering and redacting would run on a per document basis. The result of this was that for every document we'd have to run countless queries just to figure out if we could display a set of links or not. This commit changes things around so that redacting Markdown documents is no longer tied into the html-pipeline Gem. This in turn allows it to redact multiple documents in a single pass, thus reducing the number of queries needed. In turn rendering issue/merge request notes has been adjusted to take advantage of this new setup. Instead of rendering Markdown somewhere deep down in a view the Markdown is rendered and redacted in the controller (taking the current user and all that into account). This has been done in such a way that the "markdown()" helper method can still be used on its own. This particular commit also paves the way for caching rendered HTML on object level. Right now there's an accessor method Note#note_html which is used for setting/getting the rendered HTML. Once we cache HTML on row level we can simply change this field to be a column and call a "save" whenever needed and we're pretty much done.
-
- 23 Jun, 2016 9 commits
-
-
Annabel Dunstone authored
-
Annabel Dunstone authored
-
Annabel Dunstone authored
-
Connor Shea authored
-
Connor Shea authored
-
Connor Shea authored
-
Connor Shea authored
This makes larger libraries more cacheable and will allow us to use SRI with the dynamically included libraries.
-
Steve Norman authored
-
barthc authored
-
- 22 Jun, 2016 6 commits
-
-
Connor Shea authored
-
Connor Shea authored
This prevents compromised or malicious CDNs from modifying assets. The hash provided by Rails is compared to the hash of the asset the browser has downloaded. The browser will refuse to execute/parse the assets if the hashes don't match. SRI is currently implemented in Firefox, Chrome, and Opera. More information is available in #18230 and on MDN: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity This doesn't apply to the dynamically-generated per-page JavaScript due to a bug in sprockets-rails (https://github.com/rails/sprockets-rails/issues/359).
-
Felipe Artur authored
-
Felipe Artur authored
-
James Lopez authored
-
James Lopez authored
-
- 21 Jun, 2016 1 commit
-
-
Annabel Dunstone authored
Hide nav arrows by default; remove settings dropdown btn at larger breakpoint; remove unneccessary CSS
-