home/gitlabhq
2
0
Fork 0
mirror of https://github.com/wahyd4/gitlabhq.git synced 2026-08-10 21:26:07 +10:00
Code Issues Packages Projects Releases Wiki Activity
31,846 Commits 48 Branches 340 Tags
master
Commit Graph
53 Commits
Author SHA1 Message Date
Rémy Coutable aec3475df9 Fix an information disclosure when requesting access to a group containing private projects 
The issue was with the `User#groups` and `User#projects` associations
which goes through the `User#group_members` and `User#project_members`.

Initially I chose to use a secure approach by storing the requester's
user ID in `Member#created_by_id` instead of `Member#user_id` because I
was aware that there was a security risk since I didn't know the
codebase well enough.

Then during the review, we decided to change that and directly store the
requester's user ID into `Member#user_id` (for the sake of simplifying
the code I believe), meaning that every `group_members` / `project_members`
association would include the requesters by default...

My bad for not checking that all the `group_members` / `project_members`
associations and the ones that go through them (e.g. `Group#users` and
`Project#users`) were made safe with the `where(requested_at: nil)` /
`where(members: { requested_at: nil })` scopes.

Now they are all secure.

Signed-off-by: Rémy Coutable <remy@rymai.me>
 2016-06-24 12:01:48 +02:00
Douglas Barbosa Alexandre 2878c99005 Ensure Todos counters doesn't count Todos for projects pending delete 2016-06-17 16:17:43 -03:00
Paco Guzman f6bfa46daa Cache todo counters (pending/done) 
- As todos are created/updated inside the TodoService
we repopulate the cache just there for both pending/done todos
- Todos as mark as done from the TodosController we update cache
there too
- All the added methods are kept in the User class for cohesion
 2016-06-17 19:04:36 +02:00
Dmitriy Zaporozhets 253a017b01 Merge branch 'meinac/gitlab-ce-change_deprecated_render_usage' 
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
 2016-05-18 12:48:23 -05:00
Robert Speicher 24f353edc4 Merge branch '17249-starred' into 'master' 
Restrict starred projects to viewable ones

`User#starred_projects` doesn't perform any visibility checks. This has
a couple of problems:

1. It assumes a user can always view all of their starred projects in
   perpetuity (project not changed to private, access revoked, etc.).
2. It assumes that we'll only ever allow a user to star a project they
   can view. This is currently the case, but bugs happen.

Add `User#viewable_starred_projects` to filter the starred projects by
those the user either has explicit access to, or are public or
internal. Then use that in all places where we list the user's starred
projects.

Closes #17249.

See merge request !4108
 2016-05-11 12:49:29 +00:00
Sean McGivern 97424ea544 Restrict starred projects to viewable ones 
`User#starred_projects` doesn't perform any visibility checks. This has
a couple of problems:

1. It assumes a user can always view all of their starred projects in
   perpetuity (project not changed to private, access revoked, etc.).
2. It assumes that we'll only ever allow a user to star a project they
   can view. This is currently the case, but bugs happen.

Add `User#viewable_starred_projects` to filter the starred projects by
those the user either has explicit access to, or are public or
internal. Then use that in all places where we list the user's starred
projects.
 2016-05-10 18:13:52 +01:00
Alfredo Sumaran faaab2aef8 Add to label :id to response 2016-05-03 11:58:43 -05:00
Rémy Coutable ce44e5a787 Add missing Dashboard::LabelsController 2016-03-23 12:02:15 +01:00
Rémy Coutable e989d12b07 Use respond_to instead of a conditional to paginate milestones 2016-03-23 12:02:15 +01:00
Rémy Coutable 7dc16346bb Fix an issue causing the Dashboard/Milestones page to be blank 2016-03-23 12:02:15 +01:00
Robert Speicher 085538c2bd Use the configured Kaminari "per page" default 2016-03-19 17:37:54 -04:00
Douglas Barbosa Alexandre fb72271e24 Use todo.done without ! in the controller to mark todo as done 2016-03-18 11:00:53 -03:00
Phil Hughes 41c107becc Mark all as done through AJAX 2016-03-17 13:08:59 +00:00
Phil Hughes 421215e338 Removed the flash success message 
Removes the group if empty
 2016-03-17 12:54:02 +00:00
Jacob SchatzandPhil Hughes fa570525db Adds small AJAX optimistic functionality to todos. 
Fixes #13656
A good first step and boring solution.
 2016-03-17 12:20:14 +00:00
Mehmet Emin İNAÇ 6a0ea605e8 Change deprecated usage of rendering without response body 
`render nothing: true` has been deprecated.
For more information see [pr](https://github.com/rails/rails/pull/20336)
 2016-03-16 03:16:25 +02:00
Josh Frye 449954ecc2 Allow filtered dashboard/explore results to be paged. Fixes #14104 2016-03-09 21:03:28 -05:00
Dmitriy Zaporozhets acb211215c Add option to show archived projects on dahsboard 
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
 2016-03-04 19:25:28 +01:00
Dmitriy Zaporozhets afe9a07a9e Revert "Revert "Sort starred projects on dashboard based on last activity by default"" 
This reverts commit 617bb1096d.
 2016-03-03 16:00:09 +01:00
Dmitriy Zaporozhets 617bb1096d Revert "Sort starred projects on dashboard based on last activity by default" 
This reverts commit 70d6455284.
 2016-03-03 15:58:00 +01:00
Dmitriy Zaporozhets 70d6455284 Sort starred projects on dashboard based on last activity by default 
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
 2016-03-03 15:56:29 +01:00
Rémy Coutable a3f0a176ff Don't show "Welcome to GitLab" when the search didn't return any projects 2016-03-02 11:41:35 +01:00
Douglas Barbosa Alexandre 28097398c5 Does not raise an error when Todo is already marked as done 2016-02-23 10:43:29 -03:00
Douglas Barbosa Alexandre f37765efa2 Use before_action instead of before_filter 2016-02-21 12:52:37 -03:00
Douwe Maan d53ae7f14d Add "Mark all as done" button 2016-02-20 11:59:19 -08:00
Douglas Barbosa Alexandre f42b1fa6e5 Fix rubucop offenses 2016-02-20 13:10:37 -02:00
Douglas Barbosa Alexandre 3d52e139b1 Rename Tasks to Todos 2016-02-20 12:39:27 -02:00
Douglas Barbosa Alexandre 07eb334c25 Add filters by project, author, type, and action to task queue page list 2016-02-20 12:12:05 -02:00
Douglas Barbosa Alexandre 917081fe9d Fix rubocop offenses 2016-02-20 12:10:26 -02:00
Douglas Barbosa Alexandre 48ddf9a407 Remove task abilities, since we will only ever show the user their own 2016-02-20 12:10:26 -02:00
Douglas Barbosa Alexandre 38026e5f77 Add pending tasks badge on top right next to the new and logout button 2016-02-20 12:10:26 -02:00
Douglas Barbosa Alexandre 77d7910b8b Allow user to mark each task as done manually 2016-02-20 12:10:26 -02:00
Douglas Barbosa Alexandre 7cafa2ce92 Add tasks queue list page 2016-02-20 12:10:26 -02:00
Josh Frye 120dca0f35 MR feedback 2016-02-09 10:10:41 -05:00
Josh Frye 8b4e9720d9 Extract events rendering to own action. 2016-02-09 10:10:41 -05:00
Josh Frye 1a9630acc5 Fix double paging 2016-02-05 10:45:22 -05:00
Josh Frye 2ad094132d Various filter fixes 2016-02-04 13:03:41 -05:00
Josh Frye 7522ac0b3c Paginate + ajax filter dashboard projects 2016-02-04 11:40:19 -05:00
Josh Frye 87b61db7ed Page project list on dashboard 2016-02-04 11:40:19 -05:00
Dmitriy Zaporozhets 73bd729ecc Add sort dropdown to dashboard projects page 
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
 2016-02-03 20:13:26 +01:00
Yorick Peterse 128a6411d2 Don't pluck project IDs for events 
By instead using a sub-query we save ourselves the overhead of loading
any data into memory only to pass it on to another query.
 2016-01-26 10:51:53 +01:00
Gabriel Mazetto b5291f9599 Fixed Rubocop offenses 2015-12-15 00:53:52 -02:00
Dmitriy Zaporozhets 986695e136 Refactor global and group milestones logic 
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
 2015-11-16 14:07:38 +01:00
Drew Blessing 788a3f9b94 Add last push widget to starred projects dashboard 2015-10-01 15:17:32 -05:00
Douwe Maan 5d785457db Clean up overlap between dashboard and explore. 
- Split up SnippetsController into separate dashboard and explore sections.
- Use consistent page titles, header titles and sidebars between dashboard and explore sections when signed in or not.
 2015-09-08 14:49:20 +01:00
Douwe Maan 92fd3ccee0 Add helpers for header title and sidebar, and move setting those from controllers to layouts. 2015-05-01 10:39:16 +02:00
Douwe Maan 26ad250989 Add a page title to every page. 2015-04-30 19:12:15 +02:00
Jeroen van Baarsen 5a4ebfb47a Fixed the Rails/ActionFilter cop 
Signed-off-by: Jeroen van Baarsen <jeroenvanbaarsen@gmail.com>
 2015-04-20 15:39:37 +02:00
Douwe Maan 84371de01f Move group leave action from dashboard/groups to groups/group_members. 2015-03-15 13:52:28 +01:00
Dmitriy Zaporozhets f0cbbd70bb Use same constant for amount of items per page 2015-03-12 15:37:00 -07:00