Enable Devise paranoid mode and ensure the returned message is the same
every time. This will prevent user enumeration (low impact).
Prior to this change a user could type an email in the password reset
field and if the email didn't exist it returned an error. If the email
was valid it returned a message saying the forgot password link had been
emailed. After this change the user will receive a message that if the
email is in our database the reset link will be emailed.
I also changed the throttle mechanism so it still works the same but
now returns the exact same message as above. Previously it would say
'You've already sent a request. Wait a few minutes'. This also allows
user enumeration, although it requires a double-check.
Related to https://dev.gitlab.org/gitlab/gitlabhq/issues/2624
See merge request !2044
Fix problems with award-emoji-only comment
This fixes a conflict between note with only a single emoji in content
and award-emojis mechanisms.
Closes#3734
cc @vsizov
See merge request !1936
Fix Error 500 when creating global milestones with Unicode characters
Two issues:
1. The constraints in the resources were incorrect. Here's what it was before:
```
group_milestone GET /groups/:group_id/milestones/:id(.:format) groups/milestones#show {:id=>/[a-zA-Z.0-9_\-]+(?<!\.atom)/, :group_id=>/[a-zA-Z.0-9_\-]+(?<!\.atom)/}
```
In this case, id is actually the title of the milestone, which can be anything at the moment.
After:
```
group_milestone GET /groups/:group_id/milestones/:id(.:format) groups/milestones#show {:id=>/[^\/]+/, :group_id=>/[a-zA-Z.0-9_\-]+(?<!\.atom)/}
```
2. `parameterize` would strip all Unicode characters, leaving a blank string. Rails would report something like:
```
ActionView::Template::Error (No route matches {:action=>"show", :controller=>"groups/milestones", :group_id=>#<Group id: 48, name: "ops-dev", path: "ops-dev", owner_id: nil, created_at: "2015-11-15 08:55:30", updated_at: "2015-12-02 06:23:26", type: "Group", description: "", avatar: "sha1.c71e73d51af1865c1bbbf6208e10044d46c9bb93.png", public: false>, :id=>"", :title=>"肯定不是中文的问题"} missing required keys: [:id]):
```
This change uses the babosa library to create a better slug, which surprisingly
isn't actually used by the global milestone controllers. Instead, they use the
title passed as a query string for some reason.
Closes https://github.com/gitlabhq/gitlabhq/issues/9881
See merge request !1983
Fix application settings cache not expiring after changes
cache_key is an instance method that relies on updated_at. When changes
were made, the time-dependent key was being used instead of X.application_setting.last.
Closes#3609
See merge request !1972
Fix 500 when using CI
- Fix for Ci::Build state machine, allowing to process builds without the project
- Forcefully update builds that didn't want to update with state machine
- Fix saving GitLabCiService as Admin Template
Fixes#3556
See merge request !1873
Handle removed source projects in MR CI commits
Fixes#3599
@dzaporozhets assigning this to you since you wrote the original code. Perhaps checking for the source project isn't the right way, but I'm not sure if there's a better way (e.g. somewhere earlier in the process) that we can detect this.
See merge request !1859
Add upvote/downvote fields to merge request and note API to preserve compatibility
As discussed in !1825 we should not break the API compatibility.
* This MR adds the fields `upvotes`/`downvotes` to the merge request API again, which always return `0`.
* Add the fields `upvote`/`downvote` to the notes API, which always return `false`
This behavior is documented in the API docs.
See merge request !1867
Make tag API for release feature consistent
Make tags API consistent with other tags methods. This changes the endpoint from `PUT /projects/:id/repository/:tag/release` to `PUT /projects/:id/repository/tags/:tag_name/release`.
On thing the API is still missing, is an error if the tag does not exist. Right now it returns 200 even the tag does not exist. I'll fix that such it returns 404.
@stanhu Can you review?
@rspeicher This MR should go into 8.2
See merge request !1864
Fix Drone web hook URL not being updated
Fixes regression of !1774: fixes Drone Web hook for both service templates and project services.
See merge request !1856
Improve performance of user profiles, finding groups, and finding projects
This MR improves the following:
* Rendering of profile pages and Atom feeds
* Finding groups (using GroupsFinder & friends)
* Finding projects (using ProjectsFinder & friends)
Initially this MR was intended to only improve rendering of Atom feeds, but over time other fixes were introduced as well as the same code was the cause of all these problems.
See merge request !1790
Award Emoji
This it first iteration of award emoji feature.
We have plan to extend emoji picker by the next release.
For now, you can add award by clicking to the emoji picker or posting a regular comment with emoji like "👍" and any other. You can post not only emoji that listed in the emoji picker.
See merge request !1825
Commits without .gitlab-ci.yml are marked as skipped
- Commits without .gitlab-ci.yml are marked as skipped
- Save detailed error when YAML syntax
This also fixes: #3521#3546
/cc @jacobvosmaer
See merge request !1827
Prevent the last owner of a group from being able to delete themselves
by 'adding' themselves as a master
Replaces !1708.
Fixes#1111.
See merge request !1815
Ensure variable in mail is evalled
I received this snippet in the mail:
```
Content-Type: text/plain;
charset=UTF-8
Content-Transfer-Encoding: 7bit
Project #{@old_path_with_namespace} was moved to another location
The project is now located under
```
This MR fixes it.
Notes:
* I did a quick grep on other 'text.erb' files, but this was the only one with this type of error
* I made no changes to the specs. The only [spec](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/spec/mailers/notify_spec.rb#L412) I could find passes because (I assume) the correct value is in the html-part
See merge request !1706
Rewrite HTTP links to force TLS, where possible
I got annoyed at the fact that the links on the profile page don't force the use of TLS, so I grepped through the entire source tree, tested all the links I found, and replaced them if possible.
See merge request !1806
Create milestones in the group
When you work with groups its quite often you want to create same milestone in multiple projects. This MR allows you to do so
For #3488
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
See merge request !1797
