This instance was upgraded to Heptapod 0.31.0 (final) today.

  1. 04 May, 2018 6 commits
    • Tiago Botelho's avatar
      1582227fefe1
    • James Edwards-Jones's avatar
      66df2f1de13e
    • Bob Van Landuyt's avatar
      Reuses `InternalRedirect` when possible · 89902c5a6ff7
      Bob Van Landuyt authored
      `InternalRedirect` prevents Open redirect issues by only allowing
      redirection to paths on the same host.
      
      It cleans up any unwanted strings from the path that could point to
      another host (fe. //about.gitlab.com/hello). While preserving the
      querystring and fragment of the uri.
      
      It is already used by:
      
      - `TermsController`
      - `ContinueParams`
        - `ImportsController`
        - `ForksController`
      - `SessionsController`: Only for verifying the host in CE. EE allows
         redirecting to a different instance using Geo.
      89902c5a6ff7
    • Bob Van Landuyt's avatar
      Enforces terms in the web application · ad08e0582d46
      Bob Van Landuyt authored
      This enforces the terms in the web application. These cases are
      specced:
      
      - Logging in: When terms are enforced, and a user logs in that has not
        accepted the terms, they are presented with the screen. They get
        directed to their customized root path afterwards.
      - Signing up: After signing up, the first screen the user is presented
        with the screen to accept the terms. After they accept they are
        directed to the dashboard.
      - While a session is active:
        - For a GET: The user will be directed to the terms page first,
          after they accept the terms, they will be directed to the page
          they were going to
        - For any other request: They are directed to the terms, after they
          accept the terms, they are directed back to the page they came
          from to retry the request. Any information entered would be
          persisted in localstorage and available on the page.
      ad08e0582d46
    • Bob Van Landuyt's avatar
      Allow a user to accept/decline terms · 6baca23ad661
      Bob Van Landuyt authored
      When a user accepts, we store this in the agreements to keep track of
      which terms they accepted. We also update the flag on the user.
      6baca23ad661
    • Bob Van Landuyt's avatar
      Display terms to a user · c287183b3f54
      Bob Van Landuyt authored
      When terms are present, they can be viewed on `/-/users/terms`.
      c287183b3f54
  2. 03 May, 2018 1 commit
  3. 02 May, 2018 2 commits
  4. 01 May, 2018 2 commits
  5. 30 Apr, 2018 1 commit
  6. 28 Apr, 2018 2 commits
    • blackst0ne's avatar
      [Rails5] Use `safe_params` instead of `params` in `url_for` helpers · 68324b1e4b98
      blackst0ne authored
      This commits replaces `params` with `safe_params` in `url_for` helpers
      to resolve security issues [1] and failing specs with the
      
      ```
      ArgumentError:
        Attempting to generate a URL from non-sanitized request parameters!
        An attacker can inject malicious data into the generated URL, such as
        changing the host. Whitelist and sanitize passed parameters to be secure.
      ```
      
      error.
      
      [1]: https://gitlab.com/gitlab-org/gitlab-ce/issues/45168
      68324b1e4b98
    • blackst0ne's avatar
      [Rails5] Update `ApplicationController#log_exception` to fix `undefined method 'clean'` error · 14b974a1e18c
      blackst0ne authored
      This commit fixes the error:
      ```
        1) Projects::TodosController Merge Requests POST create when not authorized for merge_request doesn't create todo
           Failure/Error: application_trace = ActionDispatch::ExceptionWrapper.new(env, exception).application_trace
      
           NoMethodError:
             undefined method `clean' for #<Hash:0x000055be5bda35d0>
             Did you mean?  clear
           # ./app/controllers/application_controller.rb:113:in `log_exception'
           # ./app/controllers/application_controller.rb:40:in `block in <class:ApplicationController>'
           # ./spec/controllers/projects/todos_controller_spec.rb:80:in `go'
           # ./spec/controllers/projects/todos_controller_spec.rb:138:in `block (6 levels) in <top (required)>'
           # ./spec/controllers/projects/todos_controller_spec.rb:138:in `block (5 levels) in <top (required)>'
           # ------------------
           # --- Caused by: ---
           # ActiveRecord::RecordNotFound:
           #   Couldn't find MergeRequest
           #   ./app/finders/concerns/finder_methods.rb:19:in `raise_not_found_unless_authorized'
      
      Finished in 7.53 seconds (files took 12.8 seconds to load)
      1 example, 1 failure
      ```
      
      Also see https://github.com/rails/rails/commit/6d85804bc6aeecce5669fb4b0d7b33c069deff3a
      14b974a1e18c
  7. 27 Apr, 2018 1 commit
  8. 26 Apr, 2018 1 commit
  9. 24 Apr, 2018 1 commit
  10. 23 Apr, 2018 6 commits
  11. 22 Apr, 2018 3 commits
  12. 19 Apr, 2018 3 commits
  13. 18 Apr, 2018 2 commits
  14. 13 Apr, 2018 2 commits
  15. 11 Apr, 2018 7 commits
    • Lin Jen-Shin's avatar
      75b6cd7cb5cb
    • Yorick Peterse's avatar
      Support Markdown rendering using multiple projects · 6279781f85f9
      Yorick Peterse authored
      This refactors the Markdown pipeline so it supports the rendering of
      multiple documents that may belong to different projects. An example of
      where this happens is when displaying the event feed of a group. In this
      case we retrieve events for all projects in the group. Previously we
      would group events per project and render these chunks separately, but
      this would result in many SQL queries being executed. By extending the
      Markdown pipeline to support this out of the box we can drastically
      reduce the number of SQL queries.
      
      To achieve this we introduce a new object to the pipeline:
      Banzai::RenderContext. This object simply wraps two other objects: an
      optional Project instance, and an optional User instance. On its own
      this wouldn't be very helpful, but a RenderContext can also be used to
      associate HTML documents with specific Project instances. This work is
      done in Banzai::ObjectRenderer and allows us to reuse as many queries
      (and results) as possible.
      6279781f85f9
    • Bob Van Landuyt's avatar
      Correct permissions for creating merge requests from issues · cda254ad99ec
      Bob Van Landuyt authored
      This could only be possible for users that can create merge requests
      within a project.
      
      So they need to be a allowed to create a branch and create a merge request.
      cda254ad99ec
    • Bob Van Landuyt's avatar
      2ba7111b282b
    • Bob Van Landuyt's avatar
      Rename `create_merge_request` permissions · ccfe22c2e838
      Bob Van Landuyt authored
      So we can distinguish between the permissions on the source and the
      target project.
      
      - `create_merge_request_from` indicates a user can create a merge
        request with the project as a source_project
      - `create_merge_request_in` indicates a user can create a merge
        request with the project as a target_project
      ccfe22c2e838
    • Bob Van Landuyt's avatar
      Prevent new merge requests for archived projects · 3b9f177dc83c
      Bob Van Landuyt authored
      This prevents creating merge requests targeting archived projects.
      
      This could happen when a project was already forked, but then the
      source was archived.
      3b9f177dc83c
    • blackst0ne's avatar
      [Rails5] Fix admin/application_settings_controller · 12a96ca50cce
      blackst0ne authored
      The `RAILS5=1 rspec spec/controllers/admin/application_settings_controller_spec.rb`
      command throws the error:
      
      Failures:
      
        1) Admin::ApplicationSettingsController PUT #update falls back to defaults when settings are omitted
            Failure/Error: import_sources = params[:application_setting][:import_sources]
      
            NoMethodError:
              undefined method `[]' for nil:NilClass
            # ./app/controllers/admin/application_settings_controller.rb:62:in `application_setting_params'
      
      This commit fixes it.
      12a96ca50cce