Enable Devise paranoid mode and ensure the returned message is the same
every time. This will prevent user enumeration (low impact).
Prior to this change a user could type an email in the password reset
field and if the email didn't exist it returned an error. If the email
was valid it returned a message saying the forgot password link had been
emailed. After this change the user will receive a message that if the
email is in our database the reset link will be emailed.
I also changed the throttle mechanism so it still works the same but
now returns the exact same message as above. Previously it would say
'You've already sent a request. Wait a few minutes'. This also allows
user enumeration, although it requires a double-check.
Related to https://dev.gitlab.org/gitlab/gitlabhq/issues/2624
See merge request !2044
Fix Error 500 when creating global milestones with Unicode characters
Two issues:
1. The constraints in the resources were incorrect. Here's what it was before:
```
group_milestone GET /groups/:group_id/milestones/:id(.:format) groups/milestones#show {:id=>/[a-zA-Z.0-9_\-]+(?<!\.atom)/, :group_id=>/[a-zA-Z.0-9_\-]+(?<!\.atom)/}
```
In this case, id is actually the title of the milestone, which can be anything at the moment.
After:
```
group_milestone GET /groups/:group_id/milestones/:id(.:format) groups/milestones#show {:id=>/[^\/]+/, :group_id=>/[a-zA-Z.0-9_\-]+(?<!\.atom)/}
```
2. `parameterize` would strip all Unicode characters, leaving a blank string. Rails would report something like:
```
ActionView::Template::Error (No route matches {:action=>"show", :controller=>"groups/milestones", :group_id=>#<Group id: 48, name: "ops-dev", path: "ops-dev", owner_id: nil, created_at: "2015-11-15 08:55:30", updated_at: "2015-12-02 06:23:26", type: "Group", description: "", avatar: "sha1.c71e73d51af1865c1bbbf6208e10044d46c9bb93.png", public: false>, :id=>"", :title=>"肯定不是中文的问题"} missing required keys: [:id]):
```
This change uses the babosa library to create a better slug, which surprisingly
isn't actually used by the global milestone controllers. Instead, they use the
title passed as a query string for some reason.
Closes https://github.com/gitlabhq/gitlabhq/issues/9881
See merge request !1983
Handle removed source projects in MR CI commits
Fixes#3599
@dzaporozhets assigning this to you since you wrote the original code. Perhaps checking for the source project isn't the right way, but I'm not sure if there's a better way (e.g. somewhere earlier in the process) that we can detect this.
See merge request !1859
Make tag API for release feature consistent
Make tags API consistent with other tags methods. This changes the endpoint from `PUT /projects/:id/repository/:tag/release` to `PUT /projects/:id/repository/tags/:tag_name/release`.
On thing the API is still missing, is an error if the tag does not exist. Right now it returns 200 even the tag does not exist. I'll fix that such it returns 404.
@stanhu Can you review?
@rspeicher This MR should go into 8.2
See merge request !1864
Improve performance of user profiles, finding groups, and finding projects
This MR improves the following:
* Rendering of profile pages and Atom feeds
* Finding groups (using GroupsFinder & friends)
* Finding projects (using ProjectsFinder & friends)
Initially this MR was intended to only improve rendering of Atom feeds, but over time other fixes were introduced as well as the same code was the cause of all these problems.
See merge request !1790
Award Emoji
This it first iteration of award emoji feature.
We have plan to extend emoji picker by the next release.
For now, you can add award by clicking to the emoji picker or posting a regular comment with emoji like "👍" and any other. You can post not only emoji that listed in the emoji picker.
See merge request !1825
Commits without .gitlab-ci.yml are marked as skipped
- Commits without .gitlab-ci.yml are marked as skipped
- Save detailed error when YAML syntax
This also fixes: #3521#3546
/cc @jacobvosmaer
See merge request !1827
Check which folders and archives should be packed before passing to tar command.
If user uses backup task with SKIP and skips one of the archives listed(uploads, builds, artifacts) backup create will give an error: `Cannot stat: No such file or directory`.
This MR fixes that by checking for skipped items.
Additionally, compact everything to avoid `TypeError: no implicit conversion of nil into String` errors.
See merge request !1824
Create milestones in the group
When you work with groups its quite often you want to create same milestone in multiple projects. This MR allows you to do so
For #3488
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
See merge request !1797
Show specific runners from projects where user is master or owner
This fix for permission escalation when handling specific runners.
The users were allowed to assign runners from projects where they were guests.
See merge request !1809
refactor login as to be impersonation with better login/logout
Modifies the existing "login as" feature to be called impersonation.
This also adds:
* Application keep track of who is impersonating the user so they can revert back to the original user without having to log out.
* Stores the user profile via `HTTP_REFERER` so you get redirected back to the person you have impersonated once you stop.
## Screenshots:
See merge request !1702
Expose builds feature
Expose builds feature in project settings (as feature).
Enable it by default for a new projects.
I deliberately named it builds instead of CI, because we actualy allow to run tests using infrastructure built-in GitLab. I'm free to change it.
If we are ok, I'll add feature tests for it.
/cc @sytses @dzaporozhets
See merge request !1767
Refactor complex methods
Make flog part of CI check which is not allowed to fail. I used high score (70) and refactored most complex method. In future releases we should lower acceptable score to something like 40..50
Part of #3444
See merge request !1794
