Forbid scripting for wiki files
Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.
Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.
Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.
See merge request !1969
Fix problems with award-emoji-only comment
This fixes a conflict between note with only a single emoji in content
and award-emojis mechanisms.
Closes#3734
cc @vsizov
See merge request !1936
Award Emoji
This it first iteration of award emoji feature.
We have plan to extend emoji picker by the next release.
For now, you can add award by clicking to the emoji picker or posting a regular comment with emoji like "👍" and any other. You can post not only emoji that listed in the emoji picker.
See merge request !1825
Prevent the last owner of a group from being able to delete themselves
by 'adding' themselves as a master
Replaces !1708.
Fixes#1111.
See merge request !1815
Implement Build Artifacts
This implements #3028
1. It stores artifacts in shared/artifacts,
1. It adds `artifacts` to `.gitlab-ci.yml`,
1. We use GitLab Workhorse to offload artifacts uploading,
1. To download artifacts it uses GitLab Workhorse X-Sendfile extension,
1. There's one "artifact" per-build. The new upload removes previous one and creates a new one,
1. Default max artifact size is set to 100MB - this can be changed in settings.
Missing things:
1. Support for `.gitlab-ci.yml`: `artifacts: true or git-ls-files` which will upload all non tracked files,
1. Artifacts passing between builds.
GitLab Workhorse changes: https://gitlab.com/gitlab-org/gitlab-workhorse/merge_requests/5
GitLab Runner changes: https://gitlab.com/gitlab-org/gitlab-ci-multi-runner/merge_requests/46
Syntax:
```
artifacts:
untracked: true # default: false
paths: # default: empty
- bin/files
```
See merge request !1584
Display target branch on MR list when it is different from project's default
Fixes#3072
The screenshot below shows both previous and current UI state:
First merge request has default branch as a target, second one has non default branch as target.
See merge request !1741
- Offloads uploading to GitLab Workhorse
- Use /authorize request for fast uploading
- Added backup recipes for artifacts
- Support download acceleration using X-Sendfile
- Add page titles to CI settings.
- Fix CI admin navigation.
- Remove duplicated scope.
- Use monospace font for commit sha.
- Add page title and header title to build page.
- Proper authorization for cancel/retry builds.
- Use gitlab pagination theme for builds and group members.
- Don't paginate builds widget on build page.
- Add badges to commit page Changes/Builds tabs.
- Add "Builds" to commit Builds tab page title.
- Add and use Ci::Build#retryable? method.
- Add CI::Build#retried? method.
- Allow all failed commit builds to be retried.
- Proper authorization for cancel/retry all builds.
- Remove unused param.
- Use time_ago_with_tooltip where appropriate.
- Tweak builds index text
- Remove duplication between builds/build and commit_statuses/commit_status.
- Use POST rather than GET for canceling and retrying builds.
- Remove redundant URL helpers.
- Add build ID to build page.
- Link branch name on build page.
- Move commit/:sha/ci to commit/:sha/builds.
Simply type a name with a `/` directory separator and new directories
will be created. This does not do the fancy UI work that github.com
does, but it will get the job done.
I could not find tests for file creation, so I didn't add a test for
this slight behaviour modification. I did test directory traversals
though, using both absolute paths like `/tmp/foo.txt` and relative paths
like `../../foo.txt`. Neither case escaped the repository, though
attempting to traverse with a relative path resulted in a 500 error that
did not affect application stability upon reload.
Fix CI regressions
This MR fixes a couple of small CI regressions
- Allow developer to manage builds
- On CI Admin page show only projects that are present in GitLab
- On Runner CI Admin page show only projects that are present in GitLab
- Refresh build log only when status changes
- Show the oldest builds on top when viewing Builds - it most cases it shows running builds on top
- Fix Lint rendering
- Fix number of other builds in build widget
Fixes#3164Fixes#3161Fixesgitlab-org/gitlab-ci#343
See merge request !1679
Correctly find last known blob for file deleted in MR.
Fixes#3092.
When building a new MR, `@merge_request.commits.last` would fail because this delegates to `merge_request_diff` which is still `nil` at that point. I fixed that, and changed some of the logic because showing deleted blob contents didn't previously work for the Compare page, and the UI would show the wrong commit sha for "View File @...".
See merge request !1647
Safari 9.0 does not yet honor the HTML5 `origin-when-cross-origin` mode,
and it's possible load balancers/proxies strip the HTTP_REFERER from
the request header. In these cases, default to some default path.
Closes#3122
Closes https://github.com/gitlabhq/gitlabhq/issues/9731
This cuts down the time it takes to sort issues of a milestone by about
10x. In the previous setup the code would run a SQL query for every
issue that had to be sorted. The new setup instead runs a single SQL
query to update all the given issues at once.
The attached benchmark used to run at around 60 iterations per second,
using the new setup this hovers around 600 iterations per second. Timing
wise a request to update a milestone with 40-something issues would take
about 760 ms, in the new setup this only takes about 130 ms.
Fixes#3066
Robert SpeicherandTomasz Maczukin
Douwe MaanandTomasz Maczukin
Grzegorz BizonandRobert Speicher
Valery Sizov
Dmitriy ZaporozhetsandRobert Speicher
Kamil Trzcinski
Minsik Yoonand윤민식
Jason Lee
Drew Blessing
Anton Baklanov
Ben FordandDouwe Maan
Valery Sizov
Stan Hu
Yorick Peterse
Zeger-Jan van de Weg