We store the sizes as a hash from path to bytes like:
``` ruby
{'ci_artifacts.txt' => 27,
'other_artifacts_0.1.2/another-subdirectory/banana_sample.gif' =>
71759,
'other_artifacts_0.1.2/doc_sample.txt' => 1314,
'rails_sample.jpg' => 35255,
'tests_encoding/utf8 test dir ✓/regular_file_2' => 7}
```
So that it's easier to access than reading gzip file again.
Fix an information disclosure when requesting access to a group containing private projects
Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/19102.
The commit speaks for itself:
Fix an information disclosure when requesting access to a group containing private projects
The issue was with the `User#groups` and `User#projects` associations
which goes through the `User#group_members` and `User#project_members`.
Initially I chose to use a secure approach by storing the requester's
user ID in `Member#created_by_id` instead of `Member#user_id` because I
was aware that there was a security risk since I didn't know the
codebase well enough.
Then during the review, we decided to change that and directly store the
requester's user ID into `Member#user_id` (for the sake of simplifying
the code I believe), meaning that every `group_members` / `project_members`
association would include the requesters by default...
My bad for not checking that all the `group_members` / `project_members`
associations and the ones that go through them (e.g. `Group#users` and
`Project#users`) were made safe with the `where(requested_at: nil)` /
`where(members: { requested_at: nil })` scopes.
Now they are all secure.
See merge request !1973
Made the search bar on emoji menu sticky
## What does this MR do?
When scrolling down the emoji menu, the search bar disappears. For better UX, the search bar no stays at the top when scrolling.
## Screenshots (if relevant)
See merge request !4743
Remove duplicate new page btn from edit wiki
## What does this MR do?
Removes duplicate button on wiki page
## What are the relevant issue numbers?
Closes#19075
## Screenshots (if relevant)
See merge request !4904
Fix check for existence of New Branch button on Issue page
## What does this MR do?
The condition in [`initCanCreateBranch`][initCanCreateBranch] mistakenly checks `$container` (the New Branch button) for falsy. However JQuery returns an empty array if no matching element was found, so this condition is never met.
## Why was this MR needed?
The wrong condition causes:
* `$.getJSON($container.data('path'))` to be called where `$container.data('path')` is `undefined`
* in this case `$.getJSON` uses `location.href`
* if the current page has a JSON representation, it is fetched and cached by browser and displayed the next time the page is visited (#17365)
* otherwise "Failed to check if new branch can be created" is displayed (#17264)
## What are the relevant issue numbers?
Fixes#17264 and #17365.
[initCanCreateBranch]: https://gitlab.com/gitlab-org/gitlab-ce/blob/v8.8.4/app/assets/javascripts/issue.js.coffee#L102
See merge request !4630
Revert Subresource Integrity pending a fix for Firefox's incorrect hashing implementation.
Per the discussion in #18230, Firefox support is broken :(
cc: @jschatz1
See merge request !4943
Image sizing
## What does this MR do?
Limits image height to fit the screen. The wrapping div is so the image is guaranteed to be a block element without the link area growing to be larger than the image itself.
## Are there points in the code the reviewer needs to double check?
Make sure this can't be done in a more performant or concise way with Banzai.
## Why was this MR needed?
Images were displayed at their full resolution, which made it difficult to read issues when the image height was greater than the viewport height (see #18861).
## What are the relevant issue numbers?
Fixes#18861.
## Screenshots (if relevant)
Before:
After:
## Does this MR meet the acceptance criteria?
- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [x] Tests
- [x] Added for this feature/bug
- [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)
cc: @jschatz1 @dzaporozhets @rspeicher
See merge request !4810
Re-implement page-specific JS in a better way.
## What does this MR do?
This rebuilds the way we do page-specific JavaScript assets for a few reasons:
- The current implementation does not work with Subresource Integrity (!4808)
- The current implementation doesn't allow caching of libraries because each page we hook up with this system will have a separate application.js. Meaning that for every page that uses Ace Editor, we'd have to load Ace Editor plus any GitLab-specific scripts in the same file, making local caching of just Ace Editor impossible.
- The current implementation is rather hacky.
## Are there points in the code the reviewer needs to double check?
That Sprockets doesn't choke on this when we use precompiled assets.
## What are the relevant issue numbers?
#14372
## Does this MR meet the acceptance criteria?
- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [x] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [x] API support added
- Tests
- [x] Added for this feature/bug
- [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)
cc: @jschatz1 @pavelloz
Thanks to @pavelloz for his example implementation which was very useful.
See merge request !4883
The issue was that `MergeRequest#mergeable?` returns false when the CI
state is not success and project.only_allow_merge_if_build_succeeds is
true. In this case `Projects::MergeRequestsController#merge` would
return the `:failed` status when enabling `merge_when_build_succeeds`,
thus leading to a weird state and the MR never automatically merged.
The fix is to disable the CI state check in the controller safeguard
that early return the `:failed` status.
Signed-off-by: Rémy Coutable <remy@rymai.me>
Fix temp file being deleted after the request while importing a GitLab project
Fixes https://gitlab.com/gitlab-com/infrastructure/issues/151
In production, the temporary uploaded file is getting deleted straight after the request so the Sidekiq worker is unable to find it in `/tmp`
Also, improved erroring/logging of this situation.
See merge request !4894
The issue was with the `User#groups` and `User#projects` associations
which goes through the `User#group_members` and `User#project_members`.
Initially I chose to use a secure approach by storing the requester's
user ID in `Member#created_by_id` instead of `Member#user_id` because I
was aware that there was a security risk since I didn't know the
codebase well enough.
Then during the review, we decided to change that and directly store the
requester's user ID into `Member#user_id` (for the sake of simplifying
the code I believe), meaning that every `group_members` / `project_members`
association would include the requesters by default...
My bad for not checking that all the `group_members` / `project_members`
associations and the ones that go through them (e.g. `Group#users` and
`Project#users`) were made safe with the `where(requested_at: nil)` /
`where(members: { requested_at: nil })` scopes.
Now they are all secure.
Signed-off-by: Rémy Coutable <remy@rymai.me>
This commit changes the way certain documents are rendered (currently
only Notes) and how documents are redacted. Previously both rendering
and redacting would run on a per document basis. The result of this was
that for every document we'd have to run countless queries just to
figure out if we could display a set of links or not.
This commit changes things around so that redacting Markdown documents
is no longer tied into the html-pipeline Gem. This in turn allows it to
redact multiple documents in a single pass, thus reducing the number of
queries needed.
In turn rendering issue/merge request notes has been adjusted to take
advantage of this new setup. Instead of rendering Markdown somewhere
deep down in a view the Markdown is rendered and redacted in the
controller (taking the current user and all that into account). This has
been done in such a way that the "markdown()" helper method can still be
used on its own.
This particular commit also paves the way for caching rendered HTML on
object level. Right now there's an accessor method Note#note_html which
is used for setting/getting the rendered HTML. Once we cache HTML on row
level we can simply change this field to be a column and call a "save"
whenever needed and we're pretty much done.
Replace Haml with Hamlit
What this change does:
- It replaces HAML with [Hamlit](https://github.com/k0kubun/hamlit), a much more efficient implementation of HAML.
- It removes `haml-rails`.
- It adds `hamlit.rb` and removes `haml.rb`.
- It makes things faster and less memory-hungry!
See also #13201.
See merge request !3666
Resolve "Scrolling horz on iOS for the secondary nav is broken"
## What does this MR do?
Moves absolutely positioned `div`s outside of the scrolling container because mobile safari causes those elements to jump around on scroll.
## Are there points in the code the reviewer needs to double check?
Check on a real iPhone (was only able to check in iOS simulator)
## Why was this MR needed?
Mobile Safari.
## What are the relevant issue numbers?
Closes#18438
## Screenshots (if relevant)
See merge request !4869
Fix unwanted label unassignment
## What does this MR do?
- When updating the milestone
- [x] Do not remove labels when assigning a milestone
- [x] Do not remove labels when unassigning a milestone
- [x] Do not remove labels when assigning a milestone and adding another label
- When toggling selected issues labels should be kept
- [x] Select an issue with an assigned label -> pick another label from dropdown-> unselect the issue -> select the issue again -> submit the form: Existing label should not be removed.
## Are there points in the code the reviewer needs to double check?
Labels should not be added or removed to issues when doing bulk actions unless we explicitly select a label from the dropdown
## Does this MR meet the acceptance criteria?
- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
- [x] Added for this feature/bug
- [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)
See merge request !4863
Lin Jen-Shin
Robert Speicher
Douwe Maan
Robert Speicher
Ruben Davila
Jacob Schatz
Douwe MaanandDouwe Maan
Fatih Acet
Annabel Dunstone
Phil Hughes
winniehell
Rémy Coutable
Connor Shea
Takuya Noguchi
Stan Hu
Simon Welsh
Felipe Artur
Yorick Peterse
James Lopez
