Unblocks user when active_directory is disabled and it can be found
We implemented a specific block state to handle user blocking that originates from LDAP filtering rules / directory state in !2242.
That introduced a regression in LDAP authentication when Active Directory support was disabled. You could have a scenario where the user would not be temporarily found (like a filtering rule), that would mark the user as `ldap_blocked`, but will never unblock it automatically when that state changed.
Fixes#14253, #13179, #13259, #13959
See merge request !3550
Fix 2FA authentication spoofing
## Summary
This is security fix for vulnerability described at
https://gitlab.com/gitlab-org/gitlab-ce/issues/14900.
Attacker was able to bypass password authentication of users that have 2FA enabled, and consequently sign is as a different user, without knowing his password, if he managed to guess 2FA One Time Password for that user.
It was also possible to enumerate users and check if they have 2FA enabled, because GitLab responded with different error for each case.
## Fix
This MR attempts to change default user search scope if `otp_user_id` session variable has been set. If it is present, it means that user has 2FA enabled, and has already been verified with login and password. In this case we should look for user with `otp_user_id` first, before picking it up by `login`.
Both, 2FA authentication spoofing and 2FA discovery have been covered by specs.
## Further work
Current 2FA code is a bit tricky, so it probably needs some refactoring.
See merge request !1947
Signed-off-by: Rémy Coutable <remy@rymai.me>
Return status code 303 after a branch DELETE operation to avoid project deletion
Closes#14994
See merge request !3583
Signed-off-by: Rémy Coutable <remy@rymai.me>
Only update main language if it is not already set
Related to gitlab-org/gitlab-ce#14937 (but does not fully fix) This is a temporary fix so performance isn't affected so much.
cc @yorickpeterse @ayufan how does this look?
See merge request !3556
Signed-off-by: Rémy Coutable <remy@rymai.me>
Fixes issue with dropdowns not selecting values
Fixes issue with dropdowns not selecting when navigating between tabs
Closes#14813
See merge request !3478
Signed-off-by: Rémy Coutable <remy@rymai.me>
Fix Error 500 when searching for a comment in a project snippet
Closes#14764. /cc @stanhu, and thank you for the spec! ;)
See merge request !3468
Signed-off-by: Rémy Coutable <remy@rymai.me>
Fix Raw / Rendered diff producing different results on merge requests
The raw diff endpoint (`merge_requests/####.diff`) produces a diff based on `target_branch` instead of the original branching point. Same is valid for `merge_requests/####.patch`.
Fixes#14680, #3017
See merge request !3450
Signed-off-by: Rémy Coutable <remy@rymai.me>
Dropdown bug fixes
- Added back upcoming to milestone filter
- Fixed bug that would cause the currently selected value to disappear on filters
- Fixed bug that throw an error when filtering by upcoming when there is only a milestone in the past
Closes#14536
See merge request !3368
Signed-off-by: Rémy Coutable <remy@rymai.me>
Add links to CI setup documentation from project settings and builds pages
For #14483
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
See merge request !3384
Dropdown alignment
Hopefully the JS will stop this happening in future as well!
Closes#14386
See merge request !3298
Robert Speicher
Robert SpeicherandRobert Speicher
Yorick PeterseandRémy Coutable
Rémy CoutableandRémy Coutable
Douwe MaanandRémy Coutable
Stan HuandRémy Coutable
Jacob SchatzandRémy Coutable
Dmitriy ZaporozhetsandRémy Coutable
Achilleas Pipinellis
Nitin Madhok