Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.
Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.
- Need to pass in a `page_slug` to the filter, so it can rewrite based
on the current page (all links are rewritten to the level of the app root).
- The earlier `markdown_preview` endpoint was at the level of the wiki.
We need to know the current page (for rewriting, as above), so this
commit moves the endpoint to the level of a wiki page.
- Fix all tests
This splits the Markdown rendering and reference extraction phases into
two distinct code bases. The reference extraction phase no longer relies
on the html-pipeline Gem (and any related code) and allows for
extracting of references from multiple HTML nodes in a single pass. This
means that if you want to extract user references from 200 comments you
no longer need to run 200 times N number of queries, instead only a
handful of queries may be needed.
write_ was renamed to create_
modify_ was renamed to update_
So now in update action we have next code
def create
can?(current_user, :create_issue, @issue)
end
def update
can?(current_user, :update_issue, @issue)
end
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
Sean McGivern
Timothy Andrew
Yorick Peterse
Rémy CoutableandStan Hu
Sebastian Klier
Gabriel Mazetto
Robert Speicher
Guilherme Garnier
Dmitriy Zaporozhets
Jeroen van Baarsen
Vinnie Okada
Loic Nageleisen
Marin Jankovski