Commit Graph
4071 Commits
Author SHA1 Message Date
Timothy Andrew d915e7d5ca Reuse the private token param and header for personal access tokens.
- https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3749#note_11626427
- Personal access tokens are still a separate entity as far as the
  codebase is concerned - they just happen to use the same entry point
  as private tokens.
- Update tests and documentation to reflect this change
2016-05-11 10:16:23 +05:30
Timothy Andrew 2e9742997d Merge remote-tracking branch 'origin/master' into 2979-personal-access-tokens 2016-05-11 09:52:58 +05:30
Robert Speicher 971662e6a4 Merge branch 'stanhu/gitlab-ce-add-eager-load-lib' into 'master'
Add eager load paths to help prevent dependency load issues with Sidekiq workers

_Originally opened at !3545 by @stanhu._

- - -

Relevant resources:

- https://github.com/mperham/sidekiq/wiki/FAQ#why-doesnt-sidekiq-autoload-my-rails-application-code
- https://github.com/mperham/sidekiq/issues/1281#issuecomment-27129904
- http://blog.arkency.com/2014/11/dont-forget-about-eager-load-when-extending-autoload
- https://github.com/rails/rails/blob/52ce6ece8c8f74064bb64e0a0b1ddd83092718e1/railties/lib/rails/engine.rb#L472-L479
- https://github.com/rails/rails/blob/v4.2.6/railties/lib/rails/paths.rb

Attempts to address #3661, #11896, #12769, #13521, #14131, #14589, #14759, #14825.

See merge request !3724
2016-05-10 20:14:40 +00:00
Robert Speicher 0cc8cee6cd Merge branch 'fix/using-uploads-in-global-snippets' into 'master'
Fix using link to uploads in global snippets

Closes #17342, closes #17363

See merge request !4085
2016-05-10 17:07:10 +00:00
Grzegorz Bizon 535be93a77 Do not process upload links if no project context 2016-05-10 13:50:56 +02:00
Grzegorz Bizon 4c506c4498 Fix using link to uploads in global snippets
Closes #17342, closes #17363
2016-05-10 13:46:31 +02:00
Dmitriy Zaporozhets 21f942a5ad Merge branch 'master' of gitlab.com:gitlab-org/gitlab-ce 2016-05-10 12:51:24 +02:00
Rémy Coutable 5589dcf8db Fix a few places where autoloading would fail
- Fix naming of API::CommitStatuses
- Ensure we use require_dependency instead of require
- Ensure the namespace is right in lib/api/api.rb, otherwise, we
  might require Grape::API::Helpers which defines the `#params` method.
  This is to avoid requiring a file multiple times and getting an "Already
  initialized constant" error.

Signed-off-by: Rémy Coutable <remy@rymai.me>
2016-05-10 11:51:19 +02:00
Rémy Coutable 3af78b5c53 Merge branch 'revert-4026' into 'master'
Revert "Merge branch 'wiki-fix' into 'master'"

This reverts commit 4cc85a58e8 (!4026), reversing
changes made to 90ae445ba9.

From https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/4026#note_11719950:

>  1. On Ruby 2.1.x, the [`uri.path = ::File.join(project_wiki_base_path, uri.path)`](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/lib/banzai/filter/wiki_link_filter.rb#L39) raises an `URI::InvalidComponentError: bad component(expected relative path component): http://bar.com/baz` error in `Banzai::Filter::WikiLinkFilter#rebuild_wiki_uri`, which is then rescued in [`Banzai::Filter::WikiLinkFilter#process_link_attr`](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/lib/banzai/filter/wiki_link_filter.rb#L34), thus the link is not modified and the tests pass.
1. On Ruby 2.2.x, the same line doesn't raise an error anymore, thus tests are broken on Ruby 2.2 only. I didn't really understand yet why having absolute links in the wiki would break some tests vs having relative links as before, but I think the safest course to action is to revert this MR and to find another fix (probably just prepending `ProjectWiki#wiki_base_path` with the relative URL path component if we are in the case of a relative URL...
/cc @artem-sidorenko

Just a FYI note: no need to pick into `8-7-stable` since the original commit was not picked.

See merge request !4105
2016-05-10 09:47:55 +00:00
Yorick Peterse f96c34ec45 Merge branch 'remove-annotate-gem' into 'master'
Remove the annotate gem and delete old annotations

In 8278b763d9 the default behaviour of annotation
has changes, which was causing a lot of noise in diffs. We decided in #17382
that it is better to get rid of the whole annotate gem, and instead let people
look at schema.rb for the columns in a table.

Fixes: #17382 

/cc @yorickpeterse 

See merge request !4099
2016-05-10 09:08:30 +00:00
Rémy Coutable f52a15e022 Revert "Merge branch 'wiki-fix' into 'master' "
This reverts commit 4cc85a58e8, reversing
changes made to 90ae445ba9.

Signed-off-by: Rémy Coutable <remy@rymai.me>
2016-05-10 10:57:48 +02:00
Jeroen van Baarsen 22db5e14f2 Remove the annotate rake task 2016-05-10 07:36:44 +02:00
Benedikt Huss bf0fd3ea1b Links for redmine issue references are generated correctly again 2016-05-10 00:37:15 +02:00
Stan Hu 849cc380d8 Use a case-insensitive comparison in sanitizing URI schemes
Closes #1625
2016-05-09 12:47:53 -07:00
Robert Speicher f27fd27413 Merge branch 'cascade_drop' into 'master'
Add if exists to drop command

Add `IF EXISTS` as a precaution. Related to gitlab-org/gitlab-ce!4020

See merge request !4100
2016-05-09 18:17:57 +00:00
Drew Blessing 10d4d5842b Add if exists to drop command 2016-05-09 12:20:18 -05:00
Rémy Coutable f5240f9703 Expose MergeRequest#user_notes_count in the API and use the method in issues list
Signed-off-by: Rémy Coutable <remy@rymai.me>
2016-05-09 16:08:07 +02:00
cnam-depandRémy Coutable 5364400741 API: Expose Issue#user_notes_count 2016-05-09 16:07:35 +02:00
Artem Sidorenko 14b36f91d9 Use the proper GitLab URL for links in Wiki 2016-05-09 11:50:23 +02:00
Stan Hu 4be77d0b05 Improve multiple branch push performance by memoizing permission checking
If you attempt to push thousands of branches at once, the 60-second timeout
will occur because GitAccess checking does a lot of work to check if the
user has permission to push to a branch. This changes does two things:

1. Instead of making 1 DB query per branch push, use a memoized list of protected branches to check
2. Memoize what permissions the user has to perform on this project

On a test of 10,000 branch pushes, this prevents gitlab-shell from hitting the 60-second
timeout.

Closes #17225
2016-05-09 01:17:14 -07:00
Stan Hu 21d89d0286 Update SVG sanitizer to conform to SVG 1.1
Use a custom Loofah scrubber since sanitize 2.x transformers are inadequate
to handle case-sensitive SVG attributes. sanitize parses documents as HTML
instead of XML, which causes all SVG attribute names (e.g. viewBox) to be downcased.

* SVG element list: https://www.w3.org/TR/SVG/eltindex.html
* SVG attribute list: https://www.w3.org/TR/SVG/attindex.html

Closes #14555
2016-05-06 23:20:24 -07:00
Douwe Maan 45ef8d5eda Merge branch 'annotate-models' into 'master'
Update annotations on models



See merge request !3962
2016-05-06 11:15:04 +00:00
Zeger-Jan van de Weg 8278b763d9 Auto annotate models on migration
[ci skip]
2016-05-06 09:07:35 +02:00
Robert Speicher 00acdcf78f Merge branch 'cascade_drop' into 'master'
Rake drop tables with cascade

See merge request !4020
2016-05-06 01:54:13 +00:00
Robert Speicher 4fce876542 Merge branch 'fix/import-url-issues' into 'master'
Fix importer bug when throwing exceptions

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/15681

See merge request !3941
2016-05-05 22:27:40 +00:00
Yorick Peterse 003671207d Fix passing nil to protected_tag?
Previously this method would directly receive the output of tag_name().
This method could either return a String or nil. In the previous setup
this would somehow magically work but because Rugged::TagCollection#[]
doesn't accept nil values it started to fail.

To work around this the elsif in change_access_check() assigns the
result of tag_name() to a local and then _only_ calls protected_tag?()
if the tag name is not nil. The extra parenthesis are put in place to
ensure that things are parsed correctly, without these the code would be
parsed as follows:

    elsif tag_ref = (tag_name(ref) && protected_tag(tag_ref))

During runtime this would basically resolve to:

    elsif tag_ref = (tag_name(ref) && protected_tag(nil))

This is because when you refer to the variable you're assigning _in_ the
assignment Ruby returns nil instead of raising an error.
2016-05-05 19:46:26 +02:00
Yorick Peterse 93ce229665 Use tag_exists? in GitAccess#protected_tag?
This removes the need for retrieving the entire list of tags just to
check if a specific one exists.
2016-05-05 19:46:26 +02:00
Douglas Barbosa Alexandre 6fbf6b2936 Fix the line code when importing PR review comments from GitHub
Pull Request Review Comments are comments on a portion of the unified
diff.
2016-05-05 10:45:14 -03:00
Rémy Coutable 1a9d505972 Merge branch 'use-rugged-to-create-tag' into 'master'
Use Rugged's TagCollection#create instead of gitlab-shell's Repository#add_tag for better performance

This was originally opened at !1757 by @pcarranza but I changed it to use Rugged instead of gitlab_git, following @DouweM's request.

Once this is merged, https://gitlab.com/gitlab-org/gitlab-shell/merge_requests/26 will be mergeable too.

See merge request !3745
2016-05-04 16:07:13 +00:00
Douwe Maan 6a8359f3d3 Merge branch 'pacoguzman/gitlab-ce-15001-since-and-until-operators-api-commits'
# Conflicts:
#	Gemfile.lock
2016-05-04 17:27:47 +02:00
Rémy Coutable 44f89eafc0 Use Rugged's TagCollection#create instead of gitlab-shell's Repository#add_tag for better performance
Signed-off-by: Rémy Coutable <remy@rymai.me>
2016-05-04 17:19:13 +02:00
Drew Blessing 50d18a1e1d Rake drop tables with cascade 2016-05-03 09:29:15 -05:00
Robert Speicher c9bc3d20ef Merge remote-tracking branch 'dev/master' into 'master' 2016-05-02 19:58:54 -04:00
Paco Guzman c4b9bd0413 API support for the 'since' and 'until' operators on commit requests
- Parameter validation as ISO8601 format
2016-04-29 09:26:52 +02:00
Zeger-Jan van de Weg ad99404d25 Properly handle bigger files 2016-04-28 21:28:39 +02:00
Timothy Andrew b22a47c62e Combine API::Helpers::Core and API::Helpers::Authentication back into API::Helpers
- Makes the MR easier to read; this can go in a separate MR
- This is a (sort of) revert of 99bea01
2016-04-28 22:28:36 +05:30
Timothy Andrew fc4bce755d Make fixes based on @vsizov's comments on MR !3749 2016-04-28 22:28:36 +05:30
Timothy Andrew 611f3ad268 Fix rubocop complaints. 2016-04-28 22:28:36 +05:30
Timothy Andrew 6d76f14f54 Allow revoking personal access tokens. 2016-04-28 22:28:36 +05:30
Timothy Andrew e2a4051cc3 Allow personal access tokens to be specified in a header.
- In addition to a param.
2016-04-28 22:28:36 +05:30
Timothy Andrew 5fb4419296 Allow personal access tokens to be used for API authentication. 2016-04-28 22:28:36 +05:30
Timothy Andrew e8314ccca5 Refactor API::Helpers into API::Helpers::Core and API::Helpers::Authentication 2016-04-28 22:28:36 +05:30
Achilleas Pipinellis c73bf28143 Replace gitlab-workhorse with GitLab Workhorse where appropriate 2016-04-28 17:36:50 +03:00
Rémy Coutable 5addff7e6c Merge branch 'use-remote-ip-for-akismet' into 'master'
Use ActionDispatch Remote IP for Akismet checking

Previously all remote IPs appeared at 127.0.0.1, which made Akismet
not very useful. Using the ActionDispatch Remote IP (http://api.rubyonrails.org/classes/ActionDispatch/RemoteIp.html)
should provide more reliable results.

Closes #16629

See merge request !3961
2016-04-28 13:09:44 +00:00
Stan Hu e99cf05875 Use ActionDispatch Remote IP for Akismet checking
Previously all remote IPs appeared at 127.0.0.1, which made Akismet
not very useful. Using the ActionDispatch Remote IP (http://api.rubyonrails.org/classes/ActionDispatch/RemoteIp.html)
should provide more reliable results.

Closes #16629
2016-04-27 22:12:55 -07:00
James Lopez ce9310d63f fix var error 2016-04-27 09:28:08 +02:00
Stan Hu eede032345 Backport GitHub Enterprise import support from EE
These changes were pulled from GitLab EE to support configuring
an alternative API URL than the default https://api.github.com.
In addition, the `verify_ssl` flag allows users to disable SSL cert
checking.

One modification: add a default `args` option if it does not exist
to avoid breaking existing configurations.
2016-04-26 21:00:55 -07:00
Marin Jankovski 2f5394f5d6 Merge branch 'master' of dev.gitlab.org:gitlab/gitlabhq 2016-04-26 11:08:56 +02:00
Robert Speicher 29a23a4478 Merge branch '15579-filter-milestone-confidential-issues-api' into 'master'
Prevent information disclosure via milestone API

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15579

See merge request !1961
2016-04-26 00:37:01 +00:00
Robert Speicher 7e47f8762e Merge branch 'fix-private-snippet-api' into 'master'
Prevent information disclosure via snippet API

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15580

See merge request !1958
2016-04-25 20:30:11 +00:00