Revert "Preload lib/"
This reverts commit 5511a731bc.
The original commit added this because it also enabled threadsafety, a change which was itself later reverted in 66d6c80966, but this got left behind.
I don't fully understand the reasoning behind it so if I'm wrong, please tell me.
My reasoning for reverting it is that it messes with Rails' (and by extension Spring's) class reloading during development. When I was working in `lib/gitlab/markdown` and had to stop and restart the server every time I made a change, I didn't know it at the time, but this was why. That was a huge pain point.
If it's needed for production perhaps we could add a `if Rails.env.production?` clause around it so that it doesn't mess with development.
See merge request !1758
Exposing Project Labels in the REST API
The intent here is to expose the tag_list property of the Project entity over the REST API so that any project searches include the information. The specific reason I've implemented this change is for an environment in which multiple gitlab servers exist, where a central portal to the projects that are spread around the network will be useful. Having access to filtering on this fairly large project list based on their labels, will be of great use.
This satisfies the feature request http://feedback.gitlab.com/forums/176466-general/suggestions/6325819-project-labels-via-api
The change was made in the `lib/api/entities.rb` file.
The output of a `GET` to something like `/projects` or `/projects/7` is now:
```javascript
{
"id": 7,
"description": "Veritatis est eaque voluptas magni expedita.",
"default_branch": "master",
**"tag_list": [
"typeahead",
"twitter"
],**
"public": false,
"archived": false,
"visibility_level": 0,
...
}
```
See merge request !329
Support configurable attachment size in Application Settings page
### What does this MR do?
This MR provides the ability to configure the maximum size of an attachment inside a note. A parameter has been added to the Application Settings page.
### Are there points in the code the reviewer needs to double check?
What should be done with the legacy note attachment validation? I added code to make the validation work with the configurable setting. I could see an issue where an admin lowers the limit from 10 megabytes to 5 megabytes, which could cause an existing model to be invalid.
### Why was this MR needed?
We often have attachments that exceed 10 MB, and it would be nice to be able to override the defaults.
### What are the relevant issue numbers / [Feature requests](http://feedback.gitlab.com/)?
See Issue #1258
### Screenshots
Before:
After:
See merge request !407
Updated projects.md to show tag_list field when performing GETs
Updated projects_spec.rb to include check for tag_list key in project list
Added changes to the CHANGELOG
Import GitHub, Bitbucket or GitLab.com projects owned by authenticated user into current namespace.
Addresses #1347.
Untested since I'm in a bit of a hurry. Will definitely have time to test and add unit tests before the 7.10 release :)
See merge request !481
Don't allow username to end in period.
The current behavior doesn't do username referencing and mentioning in sentences like "I discussed with with @douwe." since `douwe.` is matched as a username.
Addresses private issue https://dev.gitlab.org/gitlab/gitlabhq/issues/2174.
See merge request !438
API: Events paginate
Updated the api method for /project/:id/events, to use the paginate method instead of limiting and offsetting the recent events in the method itself.
This will also change the first page to be 1 instead of 0, but using 0 will still work and will give back the first page.
This also add's the link headers (next/first/last).
See merge request !267
Change directory when removing old backups
Fixes errors when deleting old backups in the `gitlab:backup:create` rake task. See #2177.
See merge request !1740
Change ordering so that confirm is removed from attrs before attempting to User.build_user
Possible fix gitlab-org/gitlab-ce#1296
See merge request !445
Reduce Rack Attack false positives causing 403 errors during HTTP authentication
### What does this MR do?
This MR reduces false positives causing `403 Forbidden` messages after HTTP authentication.
A Git client may attempt to access a repository without a password. If it receives a 401 error, the client often will try again, this time supplying a password. The problem is that `grack_auth.rb` considers a blank password an authentication failure and increases a Redis counter each time this happens. With enough requests, an IP can be banned temporarily even though previous attempts may have been successful. This leads users to see `403 Forbidden` errors until the ban times out (default: 1 hour).
To reduce the chance of a false positive, this MR resets the counter upon a successful authentication from an IP.
In addition, this MR logs when a user has been banned and introduces the ability to disable Rack Attack via a config variable.
### Are there points in the code the reviewer needs to double check?
rack-attack v4.2.0 doesn't support the ability to clear counters out of the box, so `rack_attack_helpers.rb` includes a number of monkey patches to make it work. It looks like this functionality may be added in v4.3.0. I've also sent pull requests to rack-attack to add the functionality necessary to delete a key.
Each time an authentication is successful, the Redis counter for that IP is cleared. I deemed it better to clear the counter than to allow for blank passwords, since the latter seems like a security risk.
### Why was this MR needed?
It was quite difficult to figure out why users were seeing `403 Forbidden`, which is why the log message was added. Users were getting a lot of false positives when accessing repositories with HTTPS. Including the username in the HTTPS URL (e.g. `https://username@mydomain.com/account/repo.git`) caused authentication failures because while the git client provided the username, it left the password blank, leading to an authentication failure.
### What are the relevant issue numbers / [Feature requests](http://feedback.gitlab.com/)?
See Issue #1171https://github.com/kickstarter/rack-attack/issues/113
See merge request !392
Dmitriy Zaporozhets
Christoph Dreis
Dmitriy Zaporozhets
Robert Speicher
Douwe Maan
Hannes Rosenögger
Cristian Medina
Valery Sizov
Stan Hu
Marin Jankovski
Dan Tudor
Nihad Abbasov
Vinnie Okada
nicklegr
Robert Schilling
