Notes are awardables
## What does this MR do?
Makes sure we can :thunder_cloud_rain: comments/notes.
## What are the relevant issue numbers?
Follows up upon !2901, depends on !3785Closes#3655
## Screenshots (if relevant)
TODO
See merge request !4291
- Move the `TwoFactorAuthsController`'s `new` action to `show`, since
the page is not used to create a single "two factor auth" anymore. We
can have a single 2FA authenticator app, along with any number of U2F
devices, in any combination, so the page will be accessed after the
first "two factor auth" is created.
- Add the `u2f` javascript library, which provides an API to the
browser's U2F implementation.
- Add tests for the JS components
- To hold registrations from U2F devices, and to authenticate them.
- Previously, `User#two_factor_enabled` was aliased to the
`otp_required_for_login` column on `users`.
- This commit changes things a bit:
- `User#two_factor_enabled` is not a method anymore
- `User#two_factor_enabled?` checks both the
`otp_required_for_login` column, as well as `U2fRegistration`s
- Change all instances of `User#two_factor_enabled` to
`User#two_factor_enabled?`
- Add the `u2f` gem, and implement registration/authentication at the
model level.
* commit 'ca3c5c295ed653b483fe81c3918ffe60f46666b9':
Let contributors know where to start
Ensure branch cleanup regardless of whether the import process succeeds
Fix failing todo tests
Reorder the todos because the use of the project finder attempts to order them differently
Update target todo test to use a public project
Use the project finder in the todos finder to limit todos to just ones within projects you have access to.
Move filtering todos by projects not pending deletion into a scope on the todo model
Reduce the filters on the todos joins project query by being explicit about the join
Ensure we don't show TODOS for projects pending delete
Fix deprecation warnings in spec/services/issues/bulk_update_service_spec.rb
Remove unused Issuable#is_assigned? method
fixup! Don't allow merges with new commits
fixup! Add `sha` parameter to MR accept API
Reduce Namespace queries in UserReferenceFilter
Added ReferenceFilter#nodes
Returning enums in ReferenceFilter#each_node
Don't allow merges with new commits
Add `sha` parameter to MR accept API
Resolve "SHA parameter in accept merge request API"
Add a `sha` parameter to the MR merge API, which must match the source SHA for the branch to be merged.
Also add the same parameter to the UI:
@DouweM and I discussed adding some smart feature to that, like updating the source SHA on navigating to the diff tab, but for now it will just require a refresh 😃Closes#14139.
See merge request !4414
Upgrade devise, devise-two-factor, and attr_encrypted
Devise 4 includes support for Rails 5, working towards #14286. devise-async doesn't support Devise 4.0 and in 4.1 the bug that was blocking using Devise's built-in ActiveJob integration was fixed. So devise-async is removed. devise-two-factor 3.0.0 is required for Devise 4 support.
attr_encrypted and encryptor are optional but recommended upgrades for devise-two-factor 3.0.0. The mode and algorithm will need to be changed in order to update to attr_encrypted 4.x in the future.
See merge request !4216
Set a `sha` parameter on the MR form. If this doesn't match the HEAD of
the source branch when the form is submitted, show a warning (like with
a merge conflict) and don't merge the branch.
Separate reference gathering from rendering
This is a required step to allow batch processing when gathering references. This in turn would allow grabbing (for example) all mentioned users of an issue/merge request using a single query.
cc @rspeicher @DouweM
See merge request !3969
Pass the "Remember me" value to the 2FA token form
Prior, if a user had 2FA enabled and checked the "Remember me" field,
the setting was ignored because the OTP input was on a new form and the
value was never passed.
Closes#18000
See merge request !4369
Enable Wiki Page events from Webhook admin UI in a Project
* Added UI to enable page wiki events
* Documentation for this event in Webhooks page
Fixes#17506
---
See merge request !4135
Make authentication service for Container Registry to be compatible with < Docker 1.11
This removes the usage of `offline_token` which is only present when using `Docker 1.11.x` instead we relay on `scope`. This should make it compatible with any client starting from 1.6 (I did test only 1.8 and up).
Right now we return 403 if unauthorized user doesn't have access to anything. In all other cases we return token, but with empty `access`, which simply disallow requested action.
See merge request !4363
Jacob Schatz
Jacob Vosmaer (GitLab)
Kamil Trzcinski
Alfredo Sumaran
Rémy CoutableandAlfredo Sumaran
Thijs WoutersandAlfredo Sumaran
Douwe Maan
Dmitriy Zaporozhets
ZJ van de Weg
Timothy Andrew
Sean McGivernandAlfredo Sumaran
Tomasz Maczukin
Robert Speicher
Felipe Artur
Stan Hu