This prevents compromised or malicious CDNs from modifying assets. The hash provided by Rails is compared to the hash of the asset the browser has downloaded. The browser will refuse to execute/parse the assets if the hashes don't match. SRI is currently implemented in Firefox, Chrome, and Opera.
More information is available in #18230 and on MDN: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
This doesn't apply to the dynamically-generated per-page JavaScript due to a bug in sprockets-rails (https://github.com/rails/sprockets-rails/issues/359).
Fix subsequent SAML sign ins
Fixes a bug when `auto_link_ldap_user` is `true` that causes SAML users to be unable to sign in a second time.
Fix the problem for https://gitlab.zendesk.com/agent/tickets/22546
See merge request !4718
Handle external issues in IssueReferenceFilter
Handling of external issues was broken when I refactored
`IssueReferenceFilter` to use fewer SQL queries.
Fixes#18827
See merge request !4789
Update docs based on customer upgrade from 4.0
## What does this MR do?
Adds helpful notes to early upgrade docs. Without these helpful hints it will be really hard for most people to upgrade from early versions to later versions.
The tip about doing database migrations to version 6.1, then migrating iids, then migrating the database all the way was based on a tip from https://github.com/gitlabhq/gitlabhq/issues/7869. It worked really well!
See merge request !4409
Update Todos documentation and screenshots to include new functionality.
Updates documentation for todos, includes updated and new screenshots.
See also !4502 and #18906Closes#18923
[ci skip]
See merge request !4840
Hide nav arrows by default
## What does this MR do?
- Fixes the arrow icon flashing on page load
- Removes settings dropdown at higher breakpoint
- Removes unneeded CSS
Closes#18941
## Screenshots (if relevant)
Arrow flashing bug:
Settings dropdown breaking nav:
<img src="/uploads/4351035f4cf8cb9fd892b621e6339e50/Screen_Shot_2016-06-21_at_4.25.50_PM.png" width="800px">
@alfredo1 would you mind double checking this to make sure the arrow flashing is definitely not happening?
See merge request !4843
Clarify artifact expiry
## What does this MR do?
Clarifies documentation about artifact expiry.
## Are there points in the code the reviewer needs to double check?
## Why was this MR needed?
## What are the relevant issue numbers?
## Screenshots (if relevant)
See merge request !4831
Document `GIT_STRATEGY` and `GIT_DEPTH`
## What does this MR do?
Documents `GIT_STRATEGY` and `GIT_DEPTH`. Also fixes the TOC since the anchors weren't working.
## Are there points in the code the reviewer needs to double check?
The TOC and the location of the new entries.
## Why was this MR needed?
## What are the relevant issue numbers?
https://gitlab.com/gitlab-org/gitlab-ci-multi-runner/merge_requests/188
## Screenshots (if relevant)
/cc @axil @ayufan
See merge request !4720
Wrap code blocks on Activies and Todos page
## What does this MR do?
wrap code blocks on Activities and Todos page
## Are there points in the code the reviewer needs to double check?
Can `white-space: pre-wrap` be used for code blocks everywhere?
## Why was this MR needed?
Content of code blocks is cut on small screen sizes.
## What are the relevant issue numbers?
closes#18855
## Screenshots
See merge request !4783
Expand on Award Emoji documentation, update/add screenshots.
Adds documentation for award emoji now that comments can be awarded with emojis.
See also !4291 and #18906Closes#9091
cc: @virtuacreative @axil
See merge request !4839
Add some docs for Docker Registry configuration - Relatively important for anyone installing from source
There have been a few issues created because of the lack of documentation for how to configure Docker Registry when installing from source, specifically what the `realm` needs to be and the `service`
These 2 bits of info will stop a lot of headaches 👍
Issues:
https://gitlab.com/gitlab-org/gitlab-ce/issues/17957https://gitlab.com/gitlab-org/gitlab-ce/issues/17991
See merge request !4738
* Adds pipelines page to CI docs.
* Adds image of pipelines list (although currently missing border that is on other images).
* Changes CI to CI/CD in `/doc` and `/doc/ci`
* Sorts user documentation in `/doc`
Partially fixes#17733.
See merge request !4660
Fix Network graph links.
## What does this MR do?
Fixes the Network graph links so they no longer link to `/master#{escape_javascript(@commit_url)}`
## Are there points in the code the reviewer needs to double check?
Don't think so.
## Why was this MR needed?
Single quotes don't evaluate Ruby expressions.
## What are the relevant issue numbers?
Fixes#18894.
cc: @jschatz1
See merge request !4832
Fix auto-MR-close text from branch name
## What does this MR do?
Fix the MR-auto-close feature if a branch name begins with an issue IID.
## Are there points in the code the reviewer needs to double check?
It's one line, so check that line thoroughly 😃
## Why was this MR needed?
When I create a new MR from a branch starting with an issue IID, the description doesn't get suffixed with the 'Closes #blahblah' that it should do.
## What are the relevant issue numbers?
Don't think there are any.
## Screenshots (if relevant)
## Does this MR meet the acceptance criteria?
- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
See merge request !4836
Display group/project access requesters separately in admin
## What does this MR do?
It displays the access requesters in a separate list in group & project members pages.
It also harmonize the members counter UI to use `%span.badge` everywhere (in the admin & non-admin members views).
## Are there points in the code the reviewer needs to double check?
No.
## Why was this MR needed?
To not confuse access requesters with actual members.
## What are the relevant issue numbers?
Closes#18871.
## Screenshots
### Group members
| Before | After |
| --------- | ---- |
|  |  |
### Project members
| Before | After |
| --------- | ---- |
|  |  |
### Admin group members
| Before | After |
| --------- | ---- |
|  |  |
### Admin project members
| Before | After |
| --------- | ---- |
|  |  |
## Does this MR meet the acceptance criteria?
- [x] No CHANGELOG since this is related to the original "request access" MR.
- [ ] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)
See merge request !4798
Resolve "Destroying a project causes post_decline_request to be executed"
## What does this MR do?
Ensure we don't send "access request declined" to access requesters when a project is deleted.
## Are there points in the code the reviewer needs to double check?
I've created a service to decouple the notification sending from the AR model.
## Why was this MR needed?
Because there was an issue.
## What are the relevant issue numbers?
Fixes#18755, #18750.
## Does this MR meet the acceptance criteria?
- [x] No CHANGELOG needed.
- [x] Tests
- [x] Added for this feature/bug
- [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)
See merge request !4744
Resolve "Graphs and Wiki subnav"
## What does this MR do?
Styles sub nav in `Wiki` and `Graphs`
## What are the relevant issue numbers?
Closes#18533
## Screenshots (if relevant)
cc @dzaporozhets
See merge request !4678
Rename Code tab to Repository
As discussed in #18830, this renames the "Code" tab to "Repository".
Screenshot now:
See merge request !4807
Apply responsive design for Contributors graphs.
## What does this MR do?
Makes the Contributors graphs work on mobile.
## Are there points in the code the reviewer needs to double check?
That this doesn't break on any screen sizes.
## Why was this MR needed?
It used to be squished and impossible to read.
## What are the relevant issue numbers?
Fixes#18845.
## Screenshots (if relevant)
Before:
After:
cc: @jschatz1
See merge request !4801
Update gray block under subnav to match other pages
## What does this MR do?
Makes Compare sub nav full width; replaces gray block with white one to match rest of pages
## What are the relevant issue numbers?
Closes#18934
## Screenshots (if relevant)
cc @dzaporozhets
See merge request !4838
Update browser gem to 2.2.0
A user with a certain browser would hit an Error 500:
```
ArgumentError: invalid value for Float(): "0."
from browser/accept_language.rb:45:in `Float'
from browser/accept_language.rb:45:in `quality'
from browser/accept_language.rb:15:in `each'
from browser/accept_language.rb:15:in `sort_by'
from browser/accept_language.rb:15:in `parse'
from browser/base.rb:13:in `initialize'
from browser.rb:125:in `new'
from browser.rb:125:in `block in new'
from browser.rb:125:in `map'
from browser.rb:125:in `new'
from browser/action_controller.rb:15:in `browser'
from abstract_controller/helpers.rb:67:in `browser'
from app/views/layouts/_head.html.haml:38:in `_app_views_layouts__head_html_haml__1626593241142487258_59224880'
```
The root cause when the `Accept-Language` header would contain a float for the quality value (e.g. en-GB,en;q=0.v5).
Fixes https://github.com/fnando/browser/issues/241
Seen today via Sentry: https://sentry.gitlap.com/gitlab/gitlabcom/issues/7644/
See merge request !4811
Fixed private forks notice position in forks list
Moves the private forks notification item into the list on the forks page.
Closes#17671.
See merge request !4573
Connor Shea
Robert Speicher
Drew Blessing
Drew Blessing
Jacob Schatz
Dmitriy Zaporozhets
Rémy Coutable
Achilleas Pipinellis
Marin Jankovski
James Lopez
James Lopez
Mark Pundsack
Douwe Maan
Annabel Dunstone