Forbid scripting for wiki files
Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.
Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.
Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.
See merge request !1969
This solves https://dev.gitlab.org/gitlab/gitlabhq/issues/2646
1. This MR simplifies CI permission model:
- read_build: allows to read a list of builds, artifacts and trace
- update_build: allows to cancel and retry builds
- admin_build: allows to manage triggers, runners and variables
- read_commit_status: allows to read a list of commit statuses (including the status of a build, but doesn't allow to see a build details)
- create_commit_status: allows to create a new commit status using API
2. I do make sure that the proper permissions are used in all places where the CI can be shown.
3. Add the `read_build` ability if user is anonymous or guest and allow_guest_to_access_builds is enabled.
4. Add CI setting: public_builds.
5. The artifacts specific permission are removed, since they are covered by `*_build`.
Automatically fork a project when not allowed to edit a file.
Fixes#3215.
To do:
- [ ] Add tests
-----
## "Edit" button on file in a project the user does NOT have write access to
## Clicking will automatically create a fork
## When the fork has been created, the user is returned to the edit page on the original project with a notice
## The user cannot change the target branch and is informed that editing will start an MR
## Hitting "Commit changes" will commit and start an MR from my fork to the origin project
-----
## "Create file, "Upload file" and "New directory" buttons in a project the user does NOT have write access to
## Clicking any of these options will automatically create a fork
## When the fork has been created, the user is returned to the tree page on the original project with a notice
## Clicking "New directory" again will show the modal. The user cannot change the target branch and is informed that editing will start an MR
## Hitting "Create directory" will commit and start an MR from my fork to the origin project
cc @dzaporozhets @skyruler
See merge request !2145
Robert SpeicherandTomasz Maczukin
Douwe MaanandTomasz Maczukin
Kamil Trzcinski
Grzegorz Bizon
Andrew JohnsonandGrzegorz Bizon
Rémy Coutable
Dmitriy Zaporozhets
Jacob Vosmaer
Douglas Barbosa Alexandre
Valery Sizov
Drew Blessing
Zeger-Jan van de Weg