Forbid scripting for wiki files
Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.
Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.
Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.
See merge request !1969
Get "Merge when build succeeds" to work when commits were pushed to MR
target branch while builds were running
The Merge when build succeeds service only merges when the MR is
mergeable (open, not WIP, no conflicts).
When the target branch is updated, all affected MRs have their merge
status set to `unchecked`, and the conflicts check will only happen
when `check_if_can_be_merged` is called, which happens when the MR page
is viewed.
When someone enables the automatic merge, the target branch is updated,
no-one views the MR page again, and the build succeeds, the mergeability
check will fail and the MR will not in fact be merged.
This MR makes sure `check_if_can_be_merged` is always called when MR
mergeability is checked.
See merge request !2304
Ci Project migrate
- This doesn't migrate: allow_git_fetch, coverage_regex, timeout. Since this are project configuration settings I would propose to migrate them to `.gitlab-ci.yml`.
- This requires offline migrations.
- It simplifies database models making all CI objects to be attached to: Project.
- It removes Ci::Project, but makes /ci/projects working by adding method: Project.find_by_ci_id for backward compatibility (badges, triggers).
- We should add default `timeout` to Application Settings.
- It misses specs.
- It is based on ci-services-migrate for now.
- It removes CI events.
- It removes administrator CI projects overview.
- It removes CI application settings.
In 8.4 or 8.5 we can remove redundant tables and columns.
See merge request !1987
Add Builds tab to MR detail page
## Before
## After
Fixes#3907
See merge request !2016
Build related UI fixes
## Before
## After
See merge request !2015
Fix problems with award-emoji-only comment
This fixes a conflict between note with only a single emoji in content
and award-emojis mechanisms.
Closes#3734
cc @vsizov
See merge request !1936
If a Web hook test fails due to an SSL error or some other error, report
the result back to the user instead of an Error 500.
Closes#3656
Handle response
Robert SpeicherandTomasz Maczukin
Douwe MaanandTomasz Maczukin
Drew Blessing
Zeger-Jan van de Weg
Dmitriy Zaporozhets
Gabriel Mazetto
Kamil Trzciński
Greg Smethells
Marin Jankovski
Grzegorz Bizon
Stan Hu
Grzegorz Bizon
Minsik Yoon