Forbid scripting for wiki files
Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.
Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.
Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.
See merge request !1969
Improve implementation to check read access to forks and add pagination.
Fixes#13648
The following optimizations where made:
- Pagination was added.
- Code to check for read permissions to forks was optimized, in the past we were doing too many queries for each project.
See merge request !2991
Add Todos
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/2425
Tasks:
- Prepare database
- [X] Create a new table (`todos`)
- Tasks Queue view
- [X] Add a number icon showing the number of todos on the top right next to the new and logout button that will redirect the user to the todos page
- [X] Add a chronological list of todos, with the 'Todos' tab active by default
- [X] Add a 'Done' button to each todo
- [x] Add filters (project, author, type, and action)
- Todos generation
- [X] When user issue/mr is assgined to someone
- [x] When user is mentioned on (issues/mr's/comments)
- Mark todo as `done`
- [X] When clicks on the 'Done' button
- [X] When edit issue/mr
- [X] When left/edit a comment
- [X] When reassign issue/mr
- [X] When add/remove labels to issue/mr
- [X] When issue/mr is closed
- [X] When mr is merged
- [X] When added an emoji
- [X] When changed the issue/mr milestone
* Screenshot:
See merge request !2817
Make it possible to erase build content (artifacts, trace)
This feature makes it possible to remove build content - build artifacts and build traces.
- [x] Remove artifacts
- [x] Remove metadata
- [x] Remove build traces
- [x] Wait for https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/1942 this to be merged
- [x] Fix the permissions after the merge
Closes#3421
See merge request !2560
Fix milestone order in project and issue edit lists to due_date
_Originally opened at !2579 by @olirogers._
- - -
This MR orders the milestones by due date (earliest first) in the project and edit issue view. These suggestions were made be @orih in #6001 and fixes#6001.
This continues the work of !1934 to order milestones.
I found this annoying when creating milestones, found #6001 but no attached MR. This is my first for this project - comments and criticisms welcome.
See merge request !2780
This MR simplifies CI permission model:
- read_build: allows to read a list of builds, artifacts and trace
- update_build: allows to cancel and retry builds
- create_build: allows to create builds from gitlab-ci.yml (not yet implemented)
- admin_build: allows to manage triggers, runners and variables
- read_commit_status: allows to read a list of commit statuses (including the overall of builds)
- create_commit_status: allows to create a new commit status using API
Remove all extra methods to manage permission.
Made all controllers to use explicitly the new permissions.
Background process note logic for #3948
Quick and dirty way to get *most* of the note processing out of band and into the background. Seeing some pretty nice speed bumps. Keep in mind that doing this in process results in slower and slower responses as more notes are added and more participants exist.
```
without background processing
Completed 200 OK in 627ms (Views: 0.5ms | ActiveRecord: 32.3ms)
Completed 200 OK in 478ms (Views: 0.8ms | ActiveRecord: 28.3ms)
Completed 200 OK in 1107ms (Views: 0.6ms | ActiveRecord: 36.6ms)
with background processing
Completed 200 OK in 108ms (Views: 0.6ms | ActiveRecord: 4.7ms)
Completed 200 OK in 78ms (Views: 0.5ms | ActiveRecord: 4.5ms)
Completed 200 OK in 164ms (Views: 0.5ms | ActiveRecord: 8.3ms)
```
As you can see, speeds are consistent when doing the harder work out of process. I'm not sure the number of sql queries we're saving, but based on the logs alone it's a pretty good amount.
@dzaporozhets @yorickpeterse I would love some input on this.
See merge request !2631
Robert SpeicherandTomasz Maczukin
Douwe MaanandTomasz Maczukin
Rémy Coutable
Dmitriy ZaporozhetsandRémy Coutable
Douglas Barbosa AlexandreandRémy Coutable
Douwe MaanandRémy Coutable
Jacob SchatzandRémy Coutable
Grzegorz BizonandRémy Coutable
Robert Speicher
Grzegorz Bizon
Oliver RogersandRémy Coutable
kkmandRémy Coutable
Kamil Trzcinski
Jacob Vosmaer
Josh Frye