Don't show "request access" button to project owners
This MR fixes an issue where project owners that are not in the project's members list (I believe this is how we handled project owners before, now we seem to create a "Master" member for the project creator) would see the `Request Access` button.
This MR fixes this issue in a clean way by adding a new `:request_access` ability to replace an ugly helper.
It also give project owners the ability to update & destroy a requester that would happen to be themselves (since owners could request access to their own project before this MR).
Related to #18790.
See merge request !5091
Add lib/gitlab/emoji.rb instead of gitlab_emoji gem and upgrade Gemojione
- No reason to split it into a separate gem when the gem barely did anything. We can use gemojione directly, making updating gemojione that much easier. Unless there's a particularly good reason we were using the gem?
- Fixes the Rake task since it broke after all the AwardEmoji changes.
- Update gemojione to 2.6.1.
Spring Update changes! http://emojione.com/releases/#2.2.0
See merge request !4919
- Group / project members cannot request access
- Group members cannot request access to a group's project
This addresses an issue where project owners could request access
to their own project, leading to UI inconsistency where their requester
status would replace their owner status.
Signed-off-by: Rémy Coutable <remy@rymai.me>
Exclude requesters from Project#members, Group#members and User#members
## What does this MR do?
It excludes requesters from the `Project#members`, `Group#members` and `User#members` associations, and adds new `Project#requesters` and `Group#requesters` associations.
## Are there points in the code the reviewer needs to double check?
No.
## Why was this MR needed?
Without this, if you call `project.members`, requesters are included in the results! This is at best misleading, and at worst can lead to security issues. By excluding requesters from the `#members` associations, we avoid introducing security inadvertently since you have to call the `#requesters` association explicitly to get requesters.
## What are the relevant issue numbers?
This is something I realized while fixing the security issue #19102.
## Does this MR meet the acceptance criteria?
- [x] I don't think this needs a CHANGELOG since this is an internal change
- Tests
- [x] Added for this feature/bug
- [ ] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)
See merge request !4946
Memoize the maximum access level for the author of notes
Cache the maximum access level for each user in a map in the controller
In #19273, we saw that retrieving ProjectTeam#human_max_access for each note takes the bulk of the time when rendering certain issues or merge requests. We observe that most of the comments in an issue are typically done by the same users. This MR memoizes the max access level by user ID.
See merge request !4982
Fixed URL on label button when filtering
## What does this MR do?
Gives the filtered labels the correct URL. Previously they tried to link to `labels#show` whereas now it links to the correct filter path.
## What are the relevant issue numbers?
Closes#19005
See merge request !4897
No reason to split it into a separate gem when the gem barely did anything. We can use gemojione directly, making updating gemojione that much easier.
Also fix the Rake task and update gemojione to 2.6.1. This adds the EmojiOne Spring update.
Changelog: https://github.com/jonathanwiesel/gemojione/blob/master/CHANGELOG.md
In #19273, we saw that retrieving ProjectTeam#human_max_access for each
note takes the bulk of the time when rendering certain issues or merge requests.
We observe that most of the comments in an issue are typically done by the
same users. This MR memoizes the max access level by user ID.
Re-implement page-specific JS in a better way.
## What does this MR do?
This rebuilds the way we do page-specific JavaScript assets for a few reasons:
- The current implementation does not work with Subresource Integrity (!4808)
- The current implementation doesn't allow caching of libraries because each page we hook up with this system will have a separate application.js. Meaning that for every page that uses Ace Editor, we'd have to load Ace Editor plus any GitLab-specific scripts in the same file, making local caching of just Ace Editor impossible.
- The current implementation is rather hacky.
## Are there points in the code the reviewer needs to double check?
That Sprockets doesn't choke on this when we use precompiled assets.
## What are the relevant issue numbers?
#14372
## Does this MR meet the acceptance criteria?
- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [x] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [x] API support added
- Tests
- [x] Added for this feature/bug
- [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)
cc: @jschatz1 @pavelloz
Thanks to @pavelloz for his example implementation which was very useful.
See merge request !4883
Hamlit is a library that's faster than Haml while implementing most of its features: https://github.com/k0kubun/hamlit
Not sure if this breaks anything, but as far as I can tell most things work the same. No obvious regressions that I've been able to find.
Move pre_process into render_result
This MR moves `Banzai::Renderer.pre_process` into `Banzai::Renderer.render_result`.
The `pre_process` method was called even when its output would be ignored. See 11a5a4f359ee57029dbfcc9185fc6b47243ea2aa for more details.
See merge request !4830
The method Banzai::Renderer.pre_process would always be called,
regardless of whether the Markdown to render was already cached or not.
In cache the document _was_ cached the output of the pre-processing
pipeline was ignored resulting in it doing nothing but wasting CPU
cycles.
This commit moves Banzai::Renderer.pre_process into
Banzai::Renderer.render_result so that it's _only_ used when needed.
GitLab CI Yaml template dropdown
## What does this MR do?
Make it possible to select a dropdown for an easy start with GitLab CI.
## What are the relevant issue numbers?
Closes#17521
## TODO
- [ ] Backend
- [x] CHANGELOG item
- [x] Fix rubocop failure
- [x] API Support
- [x] New tests
- [x] Add disclaimer to the top of the gitlab-ci.yml
- [ ] Frontend
- [x] New tests
See merge request !4411
This commit builds on the groundwork in
ee008e300b1ec0abcc90e6a30816ec0754cea0dd, which refactored the backend
so the same code could be used for new dropdowns. In this commit its
used for templates for the `.gitlab-ci.yml` files.
Refs dropdown is now loaded async
## What does this MR do?
The refs dropdown is loaded async so not to block the page.
## What are the relevant issue numbers?
Part of #18202
## Screenshots (if relevant)
See merge request !4508
POC: Markdown shortcut buttons
## What does this MR do?
Adds markdown shortcut buttons to text area for comments.
## Are there points in the code the reviewer needs to double check?
Because changing `textarea.val('something')` kills the natural browser undo stack, I had to implement a custom undo stack using state. You can't use the "undoable" state undo pattern because you need to go back to a previous state regardless of cursor position. The undo also adds an undo history item once you delete stuff or press enter.
You can also edit multiple textareas at once and it will keep an undo history for each textarea individually, so the undo state should not collide between textareas.
## Why was this MR needed?
It has been requested multiple times and the competition has it. https://gitlab.com/gitlab-org/gitlab-ce/issues/17185#note_12073433
Libraries are available that already implement this functionality but they are enormous and bloaty. I implemented this in very few lines of code and kept it very simple and as minimal as possible. This was also some competitions approach. I believe so as to not include too much JS.
Adding extra buttons with new functionality **should only need new HTML and no new JS**.
Only extra complex thing was adding a overridden undo stack, which was made as simple as possible as well.
## What are the relevant issue numbers?
https://gitlab.com/gitlab-org/gitlab-ce/issues/17185#note_12073433
## Screenshots (if relevant)
**NOTE:** One thing you cannot see in this screenshot is that I am pressing <kbd>Cmd</kbd><kbd>Z</kbd> to undo and <kbd>Cmd</kbd><kbd>Shift</kbd><kbd>Z</kbd> to redo which is the undo/redo stack I implemented. <kbd>Ctrl</kbd><kbd>Y</kbd> also works for redo.
cc @dzaporozhets for UI
cc @iamphill @alfredo1 for JS review
cc @JobV if you like the idea.
Fixes: #17185
See merge request !4305
Douwe Maan
Patricio Cano
Robert Speicher
Rémy Coutable
Douwe Maan
Grzegorz Bizon
Jacob Vosmaer
Alejandro Rodríguez
Jacob Schatz
Fatih Acet
Connor Shea
Stan Hu
Felipe Artur
Luke "Jared" Bennett
http://jneen.net/
Phil Hughes
Yorick Peterse
Valery Sizov
Z.J. van de WegandAlfredo Sumaran
Paco Guzman