Remove persistent XSS vulnerability in `commit_person_link` helper
Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.
Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126
See merge request !1948
Signed-off-by: Rémy Coutable <remy@rymai.me>
Branded appearance to CE
Closes#11489
The difference with the EE version is only that there is no distinction between light and dark logos, though this wasn't used anyway. If this is fine, I'll create a MR on EE too.
TODO:
- [x] Copy docs
- [x] Make new screenshots
- [ ] Remove Custom Welcome message feature?
@rymai: I was unsure what labels to add to ping you, so I just ping you like this 😉
/cc @DouweM
See merge request !2927
Move "I should see Crowd login form" feature to a view spec
We were doing all kinds of code gymnastics to "enable" Crowd in the
feature spec and this would sometimes cause a transient failure.
Really what it's testing is if the Crowd login form shows when Crowd's
enabled, so this is much better suited to a view spec.
See merge request !2963
Sidebar overlaps content when screen is below 1200px.
When screen is below 1200px, the sidebar overlaps.
When screen is above 1200px, the sidebar pushes content out.
z-index change to make sure hamburger stays on top.
Fixes#12717
Also sorry I couldn't get the collapse button in the screen cap. It's there.
See merge request !2620
Add Todos
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/2425
Tasks:
- Prepare database
- [X] Create a new table (`todos`)
- Tasks Queue view
- [X] Add a number icon showing the number of todos on the top right next to the new and logout button that will redirect the user to the todos page
- [X] Add a chronological list of todos, with the 'Todos' tab active by default
- [X] Add a 'Done' button to each todo
- [x] Add filters (project, author, type, and action)
- Todos generation
- [X] When user issue/mr is assgined to someone
- [x] When user is mentioned on (issues/mr's/comments)
- Mark todo as `done`
- [X] When clicks on the 'Done' button
- [X] When edit issue/mr
- [X] When left/edit a comment
- [X] When reassign issue/mr
- [X] When add/remove labels to issue/mr
- [X] When issue/mr is closed
- [X] When mr is merged
- [X] When added an emoji
- [X] When changed the issue/mr milestone
* Screenshot:
See merge request !2817
Make it possible to erase build content (artifacts, trace)
This feature makes it possible to remove build content - build artifacts and build traces.
- [x] Remove artifacts
- [x] Remove metadata
- [x] Remove build traces
- [x] Wait for https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/1942 this to be merged
- [x] Fix the permissions after the merge
Closes#3421
See merge request !2560
workaround for forks with an invalid repo
Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/13465
The error occurs when a project returns a `nil` commit for a variety of reasons, I assume the repository is corrupt - perhaps as a result of a failed fork.
With this MR, we do not show forks with corrupted repos in the list of forks, as this does not seem to work anyway. A better solution is to fix the cause of the issue and/or any data integrity problem...
Also fixing Sentry issue: 1180
`undefined method 'already_forked?' for nil:NilClass `
See merge request !2836
Add ability to see and sort on vote count from Issues and MR lists
Fixes#3763
* Sort options
* Most popular
* Least popular
See merge request !2781
1. We now display the index of the current issuable among all its project's
issuables, of the same type and with the same state.
2. Also, refactored a bit the Issuable helpers into a new IssuablesHelper
module.
3. Added acceptance specs for the sidebar counter.
Support Akismet spam checking for creation of issues via API
Currently any spam detected by Akismet for non-members via API will
be logged in a separate table in the admin page.
Closes#5612
See merge request !2266
The problem occurred because asset compilation takes a long time, so
when the asset cache didn't exist and the first test ran, it would often
(randomly) time out during the generation before the actual test even
had a chance to run.
Now we check if the cache exists before the suite runs, and if not, we
manually fire a request to the root URL in order to generate it. This
should allow subsequent tests to use the cached assets.
Add tests for clicking a row in build artifacts browser
This adds a feature tests for clicking a row, which is handled by javascript event.
/cc @ayufan
See merge request !2551
All inputs of type `search` will have the gray background
and search icon centered.
Because the search magnifier is a bg image,
I had to hide it with `[value=""]`.
I added a little javascript to make sure each input always has it's
own value.
Douwe MaanandRémy Coutable
Jacob SchatzandRémy Coutable
Robert SpeicherandRémy Coutable
Douglas Barbosa AlexandreandRémy Coutable
Grzegorz BizonandRémy Coutable
Valery Sizov
Stan Hu
Grzegorz Bizon
Robert Speicher
Kamil Trzcinski
Dmitriy Zaporozhets
Jacob Vosmaer
Phil Hughes
James Lopez
Jacob Schatz
Rubén Dávila