Forbid scripting for wiki files
Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.
Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.
Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.
See merge request !1969
Fix 2FA authentication spoofing
This is security fix for vulnerability described at
https://gitlab.com/gitlab-org/gitlab-ce/issues/14900.
Attacker was able to bypass password authentication of users that have 2FA enabled, and consequently sign is as a different user, without knowing his password, if he managed to guess 2FA One Time Password for that user.
It was also possible to enumerate users and check if they have 2FA enabled, because GitLab responded with different error for each case.
This MR attempts to change default user search scope if `otp_user_id` session variable has been set. If it is present, it means that user has 2FA enabled, and has already been verified with login and password. In this case we should look for user with `otp_user_id` first, before picking it up by `login`.
Both, 2FA authentication spoofing and 2FA discovery have been covered by specs.
Current 2FA code is a bit tricky, so it probably needs some refactoring.
Signed-off-by: Rémy Coutable <remy@rymai.me>
Don't show "Welcome to GitLab" when the search didn't return any projects
Fixes#13785. /cc @pixdrift
### Before
### After
See merge request !3059
Fix permissions for deprecated CI build status badge
This fixes permissions for deprecated status badge, being unavailable even if project is public.
Closes#13324
See merge request !3030
Don't show any "2FA required" message if it's not actually required
Prior, if the user had enabled and then disabled 2FA, they would be
shown a "You must enable Two-factor Authentication for your account."
message when going back to re-activate it, even if 2FA enforcement was
disabled.
See merge request !3014
Improve implementation to check read access to forks and add pagination.
Fixes#13648
The following optimizations where made:
- Pagination was added.
- Code to check for read permissions to forks was optimized, in the past we were doing too many queries for each project.
See merge request !2991
Branded appearance to CE
Closes#11489
The difference with the EE version is only that there is no distinction between light and dark logos, though this wasn't used anyway. If this is fine, I'll create a MR on EE too.
TODO:
- [x] Copy docs
- [x] Make new screenshots
- [ ] Remove Custom Welcome message feature?
@rymai: I was unsure what labels to add to ping you, so I just ping you like this 😉
/cc @DouweM
See merge request !2927
Add Todos
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/2425
Tasks:
- Prepare database
- [X] Create a new table (`todos`)
- Tasks Queue view
- [X] Add a number icon showing the number of todos on the top right next to the new and logout button that will redirect the user to the todos page
- [X] Add a chronological list of todos, with the 'Todos' tab active by default
- [X] Add a 'Done' button to each todo
- [x] Add filters (project, author, type, and action)
- Todos generation
- [X] When user issue/mr is assgined to someone
- [x] When user is mentioned on (issues/mr's/comments)
- Mark todo as `done`
- [X] When clicks on the 'Done' button
- [X] When edit issue/mr
- [X] When left/edit a comment
- [X] When reassign issue/mr
- [X] When add/remove labels to issue/mr
- [X] When issue/mr is closed
- [X] When mr is merged
- [X] When added an emoji
- [X] When changed the issue/mr milestone
* Screenshot:
See merge request !2817
Make it possible to erase build content (artifacts, trace)
This feature makes it possible to remove build content - build artifacts and build traces.
- [x] Remove artifacts
- [x] Remove metadata
- [x] Remove build traces
- [x] Wait for https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/1942 this to be merged
- [x] Fix the permissions after the merge
Closes#3421
See merge request !2560
Update Gemojione for new hotness ✨
Before | After
------ | -----
 | 
See merge request !2800
Fix milestone order in project and issue edit lists to due_date
_Originally opened at !2579 by @olirogers._
- - -
This MR orders the milestones by due date (earliest first) in the project and edit issue view. These suggestions were made be @orih in #6001 and fixes#6001.
This continues the work of !1934 to order milestones.
I found this annoying when creating milestones, found #6001 but no attached MR. This is my first for this project - comments and criticisms welcome.
See merge request !2780
Remember user's inline/tabular diff view preference in a cookie
_Originally opened at !1677 by @kkm._
---
As per #3071, some users (we have a local EE installation) prefer 2-column view in diff. In this MR I add an implementation for this feature, using a cookie.
Fixes#3071.
See merge request !2723
Robert SpeicherandTomasz Maczukin
Douwe MaanandTomasz Maczukin
Rémy CoutableandRémy Coutable
Jacob Vosmaer
Dmitriy ZaporozhetsandRémy Coutable
Douglas Barbosa AlexandreandRémy Coutable
Douwe MaanandRémy Coutable
Jacob SchatzandRémy Coutable
Grzegorz BizonandRémy Coutable
Patricio CanoandRémy Coutable
Grzegorz Bizon
Oliver RogersandRémy Coutable
Josh Frye
Jason LeeandRémy Coutable
Kamil Trzcinski