Fix privilege escalation issue with OAuth external users
Related to https://gitlab.com/gitlab-org/gitlab-ce/issues/19312
This MR fixes a privilege escalation issue, where manually set external users would be reverted back to internal users if they logged in via OAuth and that provider was not in the `external_providers` list.
/cc @douwe
See merge request !1975
(cherry picked from commit 5e6342b7ac)
Check if GitHub rate limite API was reached before update Webhooks
## What does this MR do?
Checks if the job needs to sleep, and wait for the rate limit to be reseted before update each Webhook.
## Are there points in the code the reviewer needs to double check?
No.
## Why was this MR needed?
The import process can fail if the API rate limit was reached during the import process.
## What are the relevant issue numbers?
https://gitlab.com/gitlab-org/gitlab-ce/issues/17498
## Screenshots (if relevant)
Not relevant.
See merge request !4509
Adjust the SAML control flow to allow LDAP identities to be added to an existing SAML user.
It correctly lets an existing SAML user to add their LDAP identity automatically at login.
A customer had issues with the `auto_link_ldap_user` feature. The flow was not working if there was an account with a SAML identity, but no LDAP identity. GitLab would pick up the correct LDAP person, but due to the order of the flow, that LDAP person was never associated with the user.
Fixes#17346
/cc @dblessing @balameb @stanhu
See merge request !4498
Add Application Setting to configure Container Registry token expire delay (default 5min)
This adds an option to configure Container Registry token expire delay. The default is set to 5mins (something that is also used by Docker Hub).
What is left:
* [x] Write test to check the expire_delay
Fixes: https://gitlab.com/gitlab-org/gitlab-ce/issues/17890
@stanhu I think that this should land in patch release of 8.8.
See merge request !4364
Added helper methods for database migrations
These helpers can ultimately be used to write migrations that don't
require downtime.
See #15464 for more information.
See merge request !3860
Add container registry support
Tasks:
- [x] Merge docker/distribution authentication service: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3787
- [x] Implement Docker Registry API
- [x] Show a list of docker images in GitLab
- [x] Remove registry repository on project deletion
- [x] Support project rename, move and namespace rename
- [x] Use token when connecting the registry
- [x] Allow to delete images from GitLab
- [x] Support pushing from GitLab CI (gitlab-ci-token / $CI_BUILD_TOKEN)
- [x] Support GitLab Runner pulling for public repositories
- [ ] Support GitLab Runner pulling for private repositories
- [x] Add tests for Docker Registry API
- [x] Add tests for a views
- [x] Make texts nicer
- [x] Implement a backup support
- [ ] Create administration documentation https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/4141
- [ ] Create user documentation
See merge request !4040
Enable the Rubocop DeprecatedClassMethods cop
This reports uses of `File.exists?` and `Dir.exists?`, which were both
deprecated in Ruby and will eventually be removed in favor of `.exist?`.
Also fixes all existing uses of the deprecated methods.
See merge request !4087
Because method call timings are inclusive (that is, they include the
time of any sub method calls) this would lead to the total method
execution time often being far greater than the total transaction time.
Because this is incredibly confusing it's best to simply _not_ track the
total method execution time, after all it's not that useful to begin
with.
Fixesgitlab-org/gitlab-ce#17239
These helpers can be used to perform migrations without taking down the
entire application.
For example, the method "add_column_with_default" can be used to add a
new column with a default value without locking the entire table.
Only generate repository push email once
The repository push email can be very expensive to generate, especially
with syntax-highlighted diffs. Instead of generating the email for each
recipient, generate one email object and reset the Message-Id and To
headers for each recipient. (Cloning would also be expensive in the case
of large emails, although probably not as bad as generating from
scratch.)
Closes#17270.
See merge request !4070
Enable the StringReplacement cop.
Also fix one use of `gsub` that would be faster as `delete`.
Use `tr` instead of `gsub` when you are replacing the same number of characters. Use `delete` instead of `gsub` when you are deleting characters.
See merge request !3960
The repository push email can be very expensive to generate, especially
with syntax-highlighted diffs. Instead of generating the email for each
recipient, generate one email object and reset the Message-Id and To
headers for each recipient. (Cloning would also be expensive in the case
of large emails, although probably not as bad as generating from
scratch.)
Douwe MaanandRobert Speicher
Douwe MaanandTomasz Maczukin
Robert SpeicherandYorick Peterse
Stan HuandRobert Speicher
Rubén Dávila
Kamil Trzciński
Rémy Coutable
James Lopez
Sean McGivern
Pablo Carranza
Douglas Barbosa Alexandre
Artem Sidorenko
Gabriel Mazetto