From 88c15909f9e369eeef6ca9c7a1d3e16ba15b4062 Mon Sep 17 00:00:00 2001
From: Jacob Vosmaer <contact@jacobvosmaer.nl>
Date: Sat, 2 Nov 2013 16:49:26 +0100
Subject: [PATCH 1/5] Add security warnings to update docs

---
 doc/update/4.2-to-5.0.md | 3 +++
 doc/update/5.0-to-5.1.md | 3 +++
 doc/update/5.1-to-5.2.md | 3 +++
 doc/update/5.1-to-6.0.md | 3 +++
 doc/update/5.2-to-5.3.md | 3 +++
 doc/update/5.3-to-5.4.md | 3 +++
 doc/update/5.4-to-6.0.md | 3 +++
 doc/update/6.0-to-6.1.md | 3 +++
 doc/update/6.1-to-6.2.md | 3 +++
 9 files changed, 27 insertions(+)

diff --git a/doc/update/4.2-to-5.0.md b/doc/update/4.2-to-5.0.md
index 90f59e1fd1..5bf8c36773 100644
--- a/doc/update/4.2-to-5.0.md
+++ b/doc/update/4.2-to-5.0.md
@@ -1,5 +1,8 @@
 # From 4.2 to 5.0
 
+## Warning
+GitLab 5.0 is affected by critical security vulnerability CVE-2013-4490. Please update to GitLab 5.4 immediately.
+
 ## Important changes
 
 * We don't use `gitlab` user any more. Everything will be moved to `git` user
diff --git a/doc/update/5.0-to-5.1.md b/doc/update/5.0-to-5.1.md
index 45fc3436eb..bfbf926c48 100644
--- a/doc/update/5.0-to-5.1.md
+++ b/doc/update/5.0-to-5.1.md
@@ -1,5 +1,8 @@
 # From 5.0 to 5.1
 
+## Warning
+GitLab 5.1 is affected by critical security vulnerability CVE-2013-4490. Please update to GitLab 5.4 immediately.
+
 ## Release notes:
 
 * `unicorn` replaced with `puma`
diff --git a/doc/update/5.1-to-5.2.md b/doc/update/5.1-to-5.2.md
index 27f992ecfe..e6c33903f8 100644
--- a/doc/update/5.1-to-5.2.md
+++ b/doc/update/5.1-to-5.2.md
@@ -1,5 +1,8 @@
 # From 5.1 to 5.2
 
+## Warning
+GitLab 5.2 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please update to GitLab 5.4 immediately.
+
 ### 0. Backup
 
 It's useful to make a backup just in case things go south:
diff --git a/doc/update/5.1-to-6.0.md b/doc/update/5.1-to-6.0.md
index 6105d4b53b..d66ff16ffa 100644
--- a/doc/update/5.1-to-6.0.md
+++ b/doc/update/5.1-to-6.0.md
@@ -1,5 +1,8 @@
 # From 5.1 to 6.0
 
+## Warning
+GitLab 6.0 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please update to GitLab 6.2 or newer immediately.
+
 ### Deprecations
 
 #### Global projects
diff --git a/doc/update/5.2-to-5.3.md b/doc/update/5.2-to-5.3.md
index a8bb530902..0ae223e856 100644
--- a/doc/update/5.2-to-5.3.md
+++ b/doc/update/5.2-to-5.3.md
@@ -1,5 +1,8 @@
 # From 5.2 to 5.3
 
+## Warning
+GitLab 5.3 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please update to GitLab 5.4 immediately.
+
 ### 0. Backup
 
 It's useful to make a backup just in case things go south:
diff --git a/doc/update/5.3-to-5.4.md b/doc/update/5.3-to-5.4.md
index 315bf03a6d..c37cb3e45c 100644
--- a/doc/update/5.3-to-5.4.md
+++ b/doc/update/5.3-to-5.4.md
@@ -1,5 +1,8 @@
 # From 5.3 to 5.4
 
+## Notice
+Security vulnerabilities CVE-2013-4490 and CVE-2013-4489 have been patched in the latest version of GitLab 5.4.
+
 ### 0. Backup
 
 It's useful to make a backup just in case things go south:
diff --git a/doc/update/5.4-to-6.0.md b/doc/update/5.4-to-6.0.md
index 3072a1da71..83d55e2419 100644
--- a/doc/update/5.4-to-6.0.md
+++ b/doc/update/5.4-to-6.0.md
@@ -1,5 +1,8 @@
 # From 5.4 to 6.0
 
+## Warning
+GitLab 6.0 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please update to GitLab 6.2 or newer immediately.
+
 ### Deprecations
 
 #### Global projects
diff --git a/doc/update/6.0-to-6.1.md b/doc/update/6.0-to-6.1.md
index 67770bd93d..81392379b0 100644
--- a/doc/update/6.0-to-6.1.md
+++ b/doc/update/6.0-to-6.1.md
@@ -1,5 +1,8 @@
 # From 6.0 to 6.1
 
+## Warning
+GitLab 6.1 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please [update straight to 6.2](6.0-to-6.2.md).
+
 # In 6.1 we remove a lot of deprecated code.
 # You should update to 6.0 before installing 6.1 so all the necessary conversions are run.
 
diff --git a/doc/update/6.1-to-6.2.md b/doc/update/6.1-to-6.2.md
index 6f0514a861..0970f458f7 100644
--- a/doc/update/6.1-to-6.2.md
+++ b/doc/update/6.1-to-6.2.md
@@ -1,5 +1,8 @@
 # From 6.1 to 6.2
 
+## Notice
+Security vulnerabilities CVE-2013-4490 and CVE-2013-4489 have been patched in the latest version of GitLab 6.2.
+
 # You should update to 6.1 before installing 6.2 so all the necessary conversions are run.
 
 ### 0. Backup

From faa6a34a17ef12fe29fd39cf29b0f2889bfa6144 Mon Sep 17 00:00:00 2001
From: Jacob Vosmaer <contact@jacobvosmaer.nl>
Date: Sat, 2 Nov 2013 17:05:06 +0100
Subject: [PATCH 2/5] Bump gitlab-shell in 5.4 and 6.2

---
 doc/update/5.3-to-5.4.md |  4 ++--
 doc/update/6.1-to-6.2.md | 22 +++++++++++++++-------
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/doc/update/5.3-to-5.4.md b/doc/update/5.3-to-5.4.md
index c37cb3e45c..9e60f3bb8d 100644
--- a/doc/update/5.3-to-5.4.md
+++ b/doc/update/5.3-to-5.4.md
@@ -22,7 +22,7 @@ sudo -u git -H bundle exec rake gitlab:backup:create RAILS_ENV=production
 ```bash
 cd /home/git/gitlab
 sudo -u git -H git fetch
-sudo -u git -H git checkout 5-4-stable
+sudo -u git -H git checkout 5-4-stable # Latest version of 5-4-stable addresses CVE-2013-4489
 ```
 
 ### 3. Update gitlab-shell
@@ -30,7 +30,7 @@ sudo -u git -H git checkout 5-4-stable
 ```bash
 cd /home/git/gitlab-shell
 sudo -u git -H git fetch
-sudo -u git -H git checkout v1.5.0
+sudo -u git -H git checkout v1.7.4 # Addresses CVE-2013-4490
 ```
 
 ### 4. Install libs, migrations, etc.
diff --git a/doc/update/6.1-to-6.2.md b/doc/update/6.1-to-6.2.md
index 0970f458f7..2b5ad2a73a 100644
--- a/doc/update/6.1-to-6.2.md
+++ b/doc/update/6.1-to-6.2.md
@@ -24,17 +24,25 @@ sudo -u git -H bundle exec rake gitlab:backup:create RAILS_ENV=production
 ```bash
 cd /home/git/gitlab
 sudo -u git -H git fetch
-sudo -u git -H git checkout 6-2-stable
+sudo -u git -H git checkout 6-2-stable # Latest version of 6-2-stable addresses CVE-2013-4489
 ```
 
-### 3. Install additional packages
+### 3. Update gitlab-shell
+
+```bash
+cd /home/git/gitlab-shell
+sudo -u git -H git fetch
+sudo -u git -H git checkout v1.7.4 # Addresses CVE-2013-4490
+```
+
+### 4. Install additional packages
 
 ```bash
 # Add support for lograte for better log file handling
 sudo apt-get install logrotate
 ```
 
-### 4. Install libs, migrations, etc.
+### 5. Install libs, migrations, etc.
 
 ```bash
 cd /home/git/gitlab
@@ -52,7 +60,7 @@ sudo -u git -H bundle exec rake assets:precompile RAILS_ENV=production
 sudo -u git -H bundle exec rake cache:clear RAILS_ENV=production
 ```
 
-### 5. Update config files
+### 6. Update config files
 
 TIP: to see what changed in gitlab.yml.example in this release use next command: 
 
@@ -74,7 +82,7 @@ sudo -u git -H cp config/initializers/rack_attack.rb.example config/initializers
 sudo cp lib/support/logrotate/gitlab /etc/logrotate.d/gitlab
 ```
 
-### 6. Update Init script
+### 7. Update Init script
 
 ```bash
 sudo rm /etc/init.d/gitlab
@@ -82,12 +90,12 @@ sudo curl --output /etc/init.d/gitlab https://raw.github.com/gitlabhq/gitlabhq/6
 sudo chmod +x /etc/init.d/gitlab
 ```
 
-### 7. Start application
+### 8. Start application
 
     sudo service gitlab start
     sudo service nginx restart
 
-### 8. Check application status
+### 9. Check application status
 
 Check if GitLab and its environment are configured correctly:
 

From 5f0bb6cfa88d5388e855b178d7944a993ef7cb24 Mon Sep 17 00:00:00 2001
From: Jacob Vosmaer <contact@jacobvosmaer.nl>
Date: Sat, 2 Nov 2013 17:13:38 +0100
Subject: [PATCH 3/5] Add 5.1-to-5.4 update path

---
 doc/update/5.1-to-5.2.md |   2 +-
 doc/update/5.1-to-5.4.md | 103 +++++++++++++++++++++++++++++++++++++++
 doc/update/5.2-to-5.3.md |   2 +-
 3 files changed, 105 insertions(+), 2 deletions(-)
 create mode 100644 doc/update/5.1-to-5.4.md

diff --git a/doc/update/5.1-to-5.2.md b/doc/update/5.1-to-5.2.md
index e6c33903f8..a25df58a9b 100644
--- a/doc/update/5.1-to-5.2.md
+++ b/doc/update/5.1-to-5.2.md
@@ -1,7 +1,7 @@
 # From 5.1 to 5.2
 
 ## Warning
-GitLab 5.2 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please update to GitLab 5.4 immediately.
+GitLab 5.2 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please [update to GitLab 5.4 directly](5.1-to-5.4.md).
 
 ### 0. Backup
 
diff --git a/doc/update/5.1-to-5.4.md b/doc/update/5.1-to-5.4.md
new file mode 100644
index 0000000000..e61303a654
--- /dev/null
+++ b/doc/update/5.1-to-5.4.md
@@ -0,0 +1,103 @@
+# From 5.1 to 5.4
+Also works starting from 5.2.
+
+## Notice
+Security vulnerabilities CVE-2013-4490 and CVE-2013-4489 have been patched in the latest version of GitLab 5.4.
+
+### 0. Backup
+
+It's useful to make a backup just in case things go south:
+(With MySQL, this may require granting "LOCK TABLES" privileges to the GitLab user on the database version)
+
+```bash
+cd /home/git/gitlab
+sudo -u git -H bundle exec rake gitlab:backup:create RAILS_ENV=production
+```
+
+### 1. Stop server
+
+    sudo service gitlab stop
+
+### 2. Get latest code
+
+```bash
+cd /home/git/gitlab
+sudo -u git -H git fetch
+sudo -u git -H git checkout 5-4-stable # Latest version of 5-4-stable addresses CVE-2013-4489
+```
+
+### 3. Update gitlab-shell
+
+```bash
+cd /home/git/gitlab-shell
+sudo -u git -H git fetch
+sudo -u git -H git checkout v1.7.4 # Addresses CVE-2013-4490
+```
+
+### 4. Install libs, migrations, etc.
+
+```bash
+cd /home/git/gitlab
+
+# MySQL
+sudo -u git -H bundle install --without development test postgres --deployment
+
+#PostgreSQL
+sudo -u git -H bundle install --without development test mysql --deployment
+
+sudo -u git -H bundle exec rake db:migrate RAILS_ENV=production
+
+sudo -u git -H bundle exec rake assets:precompile RAILS_ENV=production
+```
+
+### 5. Update config files
+
+* Make `/home/git/gitlab/config/gitlab.yml` same as https://github.com/gitlabhq/gitlabhq/blob/5-4-stable/config/gitlab.yml.example but with your settings.
+* Make `/home/git/gitlab/config/puma.rb` same as https://github.com/gitlabhq/gitlabhq/blob/5-4-stable/config/puma.rb.example but with your settings.
+
+### 6. Update Init script
+
+```bash
+sudo rm /etc/init.d/gitlab
+sudo cp lib/support/init.d/gitlab /etc/init.d/gitlab
+sudo chmod +x /etc/init.d/gitlab
+```
+
+### 7. Create uploads directory
+
+```bash
+cd /home/git/gitlab
+sudo -u git -H mkdir public/uploads
+sudo chmod -R u+rwX  public/uploads
+```
+
+
+### 8. Start application
+
+    sudo service gitlab start
+    sudo service nginx restart
+
+### 9. Check application status
+
+Check if GitLab and its environment are configured correctly:
+
+    sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production
+
+To make sure you didn't miss anything run a more thorough check with:
+
+    sudo -u git -H bundle exec rake gitlab:check RAILS_ENV=production
+
+If all items are green, then congratulations upgrade complete!
+
+## Things went south? Revert to previous version (5.3)
+
+### 1. Revert the code to the previous version
+Follow the [`upgrade guide from 5.2 to 5.3`](5.2-to-5.3.md), except for the database migration 
+(The backup is already migrated to the previous version)
+
+### 2. Restore from the backup:
+
+```bash
+cd /home/git/gitlab
+sudo -u git -H bundle exec rake gitlab:backup:restore RAILS_ENV=production
+```
diff --git a/doc/update/5.2-to-5.3.md b/doc/update/5.2-to-5.3.md
index 0ae223e856..67517b23d3 100644
--- a/doc/update/5.2-to-5.3.md
+++ b/doc/update/5.2-to-5.3.md
@@ -1,7 +1,7 @@
 # From 5.2 to 5.3
 
 ## Warning
-GitLab 5.3 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please update to GitLab 5.4 immediately.
+GitLab 5.3 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please [update to GitLab 5.4 directly](5.1-to-5.4.md).
 
 ### 0. Backup
 

From 81f69b5d310a958d93d7e433c0446730e4fa4e82 Mon Sep 17 00:00:00 2001
From: Jacob Vosmaer <contact@jacobvosmaer.nl>
Date: Sat, 2 Nov 2013 17:24:43 +0100
Subject: [PATCH 4/5] Clarify upgrade steps

---
 doc/update/5.0-to-5.1.md | 2 +-
 doc/update/5.1-to-6.0.md | 2 +-
 doc/update/5.4-to-6.0.md | 2 +-
 doc/update/6.0-to-6.1.md | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/update/5.0-to-5.1.md b/doc/update/5.0-to-5.1.md
index bfbf926c48..24d96e43ba 100644
--- a/doc/update/5.0-to-5.1.md
+++ b/doc/update/5.0-to-5.1.md
@@ -1,7 +1,7 @@
 # From 5.0 to 5.1
 
 ## Warning
-GitLab 5.1 is affected by critical security vulnerability CVE-2013-4490. Please update to GitLab 5.4 immediately.
+GitLab 5.1 is affected by critical security vulnerability CVE-2013-4490. Please [update to GitLab 5.4 immediately](5.1-to-5.4.md).
 
 ## Release notes:
 
diff --git a/doc/update/5.1-to-6.0.md b/doc/update/5.1-to-6.0.md
index d66ff16ffa..3907af1f98 100644
--- a/doc/update/5.1-to-6.0.md
+++ b/doc/update/5.1-to-6.0.md
@@ -1,7 +1,7 @@
 # From 5.1 to 6.0
 
 ## Warning
-GitLab 6.0 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please update to GitLab 6.2 or newer immediately.
+GitLab 6.0 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please [update to GitLab 6.2 immediately](6.0-to-6.2.md).
 
 ### Deprecations
 
diff --git a/doc/update/5.4-to-6.0.md b/doc/update/5.4-to-6.0.md
index 83d55e2419..1137f37151 100644
--- a/doc/update/5.4-to-6.0.md
+++ b/doc/update/5.4-to-6.0.md
@@ -1,7 +1,7 @@
 # From 5.4 to 6.0
 
 ## Warning
-GitLab 6.0 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please update to GitLab 6.2 or newer immediately.
+GitLab 6.0 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please [update to GitLab 6.2 immediately](6.0-to-6.2.md).
 
 ### Deprecations
 
diff --git a/doc/update/6.0-to-6.1.md b/doc/update/6.0-to-6.1.md
index 81392379b0..43ec211fd1 100644
--- a/doc/update/6.0-to-6.1.md
+++ b/doc/update/6.0-to-6.1.md
@@ -1,7 +1,7 @@
 # From 6.0 to 6.1
 
 ## Warning
-GitLab 6.1 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please [update straight to 6.2](6.0-to-6.2.md).
+GitLab 6.1 is affected by critical security vulnerabilities CVE-2013-4490 and CVE-2013-4489. Please [update to GitLab 6.2 directly](6.0-to-6.2.md).
 
 # In 6.1 we remove a lot of deprecated code.
 # You should update to 6.0 before installing 6.1 so all the necessary conversions are run.

From 7265b4068d0a9b83b34cc7b802041e37199ba90f Mon Sep 17 00:00:00 2001
From: Jacob Vosmaer <contact@jacobvosmaer.nl>
Date: Sat, 2 Nov 2013 17:32:14 +0100
Subject: [PATCH 5/5] Add security update info to 6.0-to-6.2.md

---
 doc/update/6.0-to-6.2.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/doc/update/6.0-to-6.2.md b/doc/update/6.0-to-6.2.md
index 656bcaffdd..00a27fcd43 100644
--- a/doc/update/6.0-to-6.2.md
+++ b/doc/update/6.0-to-6.2.md
@@ -1,5 +1,8 @@
 # From 6.0 to 6.2
 
+## Notice
+Security vulnerabilities CVE-2013-4490 and CVE-2013-4489 have been patched in the latest version of GitLab 6.2.
+
 # In 6.1 we remove a lot of deprecated code.
 # You should update to 6.0 before installing 6.1 or higher so all the necessary conversions are run.
 
@@ -28,7 +31,7 @@ sudo -u git -H bundle exec rake gitlab:backup:create RAILS_ENV=production
 ```bash
 cd /home/git/gitlab
 sudo -u git -H git fetch
-sudo -u git -H git checkout 6-2-stable
+sudo -u git -H git checkout 6-2-stable # Latest version of 6-2-stable addresses CVE-2013-4489
 ```
 
 
@@ -44,7 +47,7 @@ sudo apt-get install logrotate
 ```bash
 cd /home/git/gitlab-shell
 sudo -u git -H git fetch
-sudo -u git -H git checkout v1.7.4
+sudo -u git -H git checkout v1.7.4 # Addresses CVE-2013-4490
 ```
 
 ### 5. Install libs, migrations, etc.