From 6fd06006856bd7f06c5bf15db2ef064cba043a58 Mon Sep 17 00:00:00 2001
From: unknown <tostercx@gmail.com>
Date: Wed, 4 Mar 2015 19:56:41 +0200
Subject: [PATCH 1/2] Bugfix #1096

---
 app/assets/javascripts/blob/edit_blob.js.coffee | 2 +-
 app/assets/javascripts/blob/new_blob.js.coffee  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/assets/javascripts/blob/edit_blob.js.coffee b/app/assets/javascripts/blob/edit_blob.js.coffee
index 6914ca759f..2e91a06daa 100644
--- a/app/assets/javascripts/blob/edit_blob.js.coffee
+++ b/app/assets/javascripts/blob/edit_blob.js.coffee
@@ -15,7 +15,7 @@ class @EditBlob
     $(".js-commit-button").click ->
       $("#file-content").val editor.getValue()
       $(".file-editor form").submit()
-      return
+      return false
 
     editModePanes = $(".js-edit-mode-pane")
     editModeLinks = $(".js-edit-mode a")
diff --git a/app/assets/javascripts/blob/new_blob.js.coffee b/app/assets/javascripts/blob/new_blob.js.coffee
index a6e27116b4..ab8f98715e 100644
--- a/app/assets/javascripts/blob/new_blob.js.coffee
+++ b/app/assets/javascripts/blob/new_blob.js.coffee
@@ -15,7 +15,7 @@ class @NewBlob
     $(".js-commit-button").click ->
       $("#file-content").val editor.getValue()
       $(".file-editor form").submit()
-      return
+      return false
 
   editor: ->
     return @editor

From 9f089ac48c22b2f7cfbc7dd0ca29da924c566363 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@higgsboson.tk>
Date: Fri, 6 Mar 2015 19:49:38 +0100
Subject: [PATCH 2/2] use constant-time string compare for internal api
 authentication

Ruby str_equal uses memcmp internally to compare String.
Memcmp is vunerable to timing attacks because it returns early
on mismatch (on most x32 platforms memcmp uses a bytewise comparision).
Devise.secure_compare implements a constant time comparision instead.
---
 lib/api/helpers.rb | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb
index 228a719fbd..ee678d84c8 100644
--- a/lib/api/helpers.rb
+++ b/lib/api/helpers.rb
@@ -83,7 +83,10 @@ module API
     end
 
     def authenticate_by_gitlab_shell_token!
-      unauthorized! unless secret_token == params['secret_token'].try(:chomp)
+      input = params['secret_token'].try(:chomp)
+      unless Devise.secure_compare(secret_token, input)
+        unauthorized!
+      end
     end
 
     def authenticated_as_admin!