Fix 2FA authentication spoofing
This is security fix for vulnerability described at
https://gitlab.com/gitlab-org/gitlab-ce/issues/14900.
Attacker was able to bypass password authentication of users that have 2FA enabled, and consequently sign is as a different user, without knowing his password, if he managed to guess 2FA One Time Password for that user.
It was also possible to enumerate users and check if they have 2FA enabled, because GitLab responded with different error for each case.
This MR attempts to change default user search scope if `otp_user_id` session variable has been set. If it is present, it means that user has 2FA enabled, and has already been verified with login and password. In this case we should look for user with `otp_user_id` first, before picking it up by `login`.
Both, 2FA authentication spoofing and 2FA discovery have been covered by specs.
Current 2FA code is a bit tricky, so it probably needs some refactoring.
Signed-off-by: Rémy Coutable <remy@rymai.me>
Fix permissions for deprecated CI build status badge
This fixes permissions for deprecated status badge, being unavailable even if project is public.
Closes#13324
See merge request !3030
Fix atom url issue on projects
This MR adds prevents a project to have a path ending in .atom that conflicts with the feed
and
Adds a migration to migrate old .atom projects to a different path
Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/3699
See merge request !2651
Make the `/groups` route behave as expected
The route is supposed to redirect the Groups#index request based on
whether or not a user was logged in. If they are, we redirect them to
their groups dashboard; if they're not, we redirect them to the public
Explore page.
But due to overly aggressive `before_action`s that weren't excluding (or including) the
`index` action, the request always resulted in a 404, whether a user was
logged in or not.
Closes#12660
See merge request !2580
The route is supposed to redirect the Groups#index request based on
whether or not a user was logged in. If they are, we redirect them to
their groups dashboard; if they're not, we redirect them to the public
Explore page.
But due to overly aggressive `before_action`s that weren't excluding the
`index` action, the request always resulted in a 404, whether a user was
logged in or not.
Closes#12660
Unsubscribe from thread through link in email footer
Closes#3437
See merge request !2068
Two issues:
1. The constraints in the resources were incorrect. Here's what it was before:
```
group_milestone GET /groups/:group_id/milestones/:id(.:format) groups/milestones#show {:id=>/[a-zA-Z.0-9_\-]+(?<!\.atom)/, :group_id=>/[a-zA-Z.0-9_\-]+(?<!\.atom)/}
```
In this case, id is actually the title of the milestone, which can be anything at the moment.
After:
```
group_milestone GET /groups/:group_id/milestones/:id(.:format) groups/milestones#show {:id=>/[^\/]+/, :group_id=>/[a-zA-Z.0-9_\-]+(?<!\.atom)/}
```
2. `parameterize` would strip all Unicode characters, leaving a blank string. Rails would report something like:
ActionView::Template::Error (No route matches {:action=>"show", :controller=>"groups/milestones", :group_id=>#<Group id: 48, name: "ops-dev", path: "ops-dev", owner_id: nil, created_at: "2015-11-15 08:55:30", updated_at: "2015-12-02 06:23:26", type: "Group", description: "", avatar: "sha1.c71e73d51af1865c1bbbf6208e10044d46c9bb93.png", public: false>, :id=>"", :title=>"肯定不是中文的问题"} missing required keys: [:id]):
This change uses the babosa library to create a better slug, which surprisingly
isn't actually used by the global milestone controllers. Instead, they use the
title passed as a query string for some reason.
Closes https://github.com/gitlabhq/gitlabhq/issues/9881
Fix constraints
Previously this controller would in multiple places load tons (read:
around 65000) project and/or group IDs into memory. These changes in
combination with the previous commits significantly cut down loading
times of user profile pages and the Atom feeds of users.
Robert SpeicherandRobert Speicher
Rémy CoutableandRémy Coutable
Douwe MaanandRémy Coutable
James Lopez
Douglas Barbosa Alexandre
Stan HuandDouglas Barbosa Alexandre
Douwe Maan
Zeger-Jan van de Weg
Gabriel Mazetto
Jacob Vosmaer
Marin Jankovski
Andrew Tomaka
Minsik Yoon
Valery Sizov
Dmitriy Zaporozhets
Yorick Peterse