4924 Commits
Author SHA1 Message Date
Yorick Peterse 8ec1dcf247 Revert "Merge branch 'fix-build-notification-on-merge-page-change' into 'master' "
This reverts commit d1ba098695.
2016-05-11 12:30:45 +02:00
Robert SpeicherandYorick Peterse 5ec4347067 Merge branch 'xss-case-insensitive-protocol' into 'master'
Use a case-insensitive check to compare URI schemes

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/17299

See merge request !1965
2016-05-11 11:06:31 +02:00
Stan HuandYorick Peterse d1ba098695 Merge branch 'fix-build-notification-on-merge-page-change' into 'master'
Fix build notification on merge request page change even if the build status didn't change

## What does this MR do?
This MR contains a bugfix for #17357 which was introduced by !3998. The notification are now only shown on status changes, and not when switching between different merge requests.

## Are there points in the code the reviewer needs to double check?
Check implementation

## Why was this MR needed?
Because auf a bug introduced in !3998.

## What are the relevant issue numbers?
#17357

Closes #17357

See merge request !4086
2016-05-11 11:01:05 +02:00
Rémy CoutableandYorick Peterse 0034e4f398 Merge branch 'trusted-proxies-ip-addr' into 'master'
Pass trusted_proxies to action_dispatch as IPAddrs instead of strings

Without this setting your own trusted_proxies does not work.

Fixes an issue introduce in: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3524

Fixes: https://gitlab.com/gitlab-org/gitlab-ce/issues/17004

See merge request !3970
2016-05-11 11:00:11 +02:00
Robert SpeicherandYorick Peterse fc8214ea83 Merge branch 'fix/import-url-issues' into 'master'
Fix importer bug when throwing exceptions

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/15681

See merge request !3941
2016-05-11 11:00:01 +02:00
Douwe MaanandYorick Peterse 0f6894d6a6 Merge branch 'create-wikis-during-check' into 'master'
Initialize wikis on legacy projects during check

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/4173

Helps https://gitlab.com/gitlab-org/gitlab-ce/issues/15423

See merge request !3931
2016-05-05 19:37:04 +02:00
Douwe MaanandYorick Peterse 4f9d82a9e3 Merge branch 'gh-review-comments' into 'master'
Fix the line code when importing PR review comments from GitHub

Pull Request Review Comments are comments on a portion of the unified diff.

Closes #17205

See merge request !4010
2016-05-05 19:35:54 +02:00
Stan HuandYorick Peterse ee11b9778c Merge branch 'fix-team-build-state-in-mr-widget' into 'master'
Merge request widget displays TeamCity build state and code coverage correctly again

## What does this MR do?
This MR contains a fix for a regression introduced in `8.7`. In former version, the TeamCity build status was always displayed correctly. In `8.7` the build state is still checked, but the UI is not updated correctly any longer.

## Are there points in the code the reviewer needs to double check?
The changes are quite simple, so please simply double check them.

## Why was this MR needed?
This MR is needed to make the TeamCity build status working again.

## What are the relevant issue numbers?
#17080 

See merge request !3998
2016-05-05 10:06:59 +02:00
Robert SpeicherandYorick Peterse aa664af3dd Merge branch '15527-fix-wiki-page-creation-issue' into 'master'
Fix error when trying to create a wiki page

Closes #15527, #15569, #15623, #15630, #15637, #15653, #15870, #16558, #16875, #16987, #17016, https://github.com/gitlabhq/gitlabhq/issues/10317.

See merge request !3924
2016-05-03 09:42:16 +00:00
Robert Speicher 6f0cadca87 Merge remote-tracking branch 'dev/8-7-stable' into 8-7-stable 2016-05-02 20:00:11 -04:00
Jacob SchatzandYorick Peterse ea066cc1bf Merge branch 'async-new-branch-button' into 'master'
Load the "New Branch" button asynchronously

Here's how it looks like for logged in users:

![new_branch](/uploads/718e3d9016a50a0432b9541dde5ca74c/new_branch.gif)

And here it is for anonymous users (or when a new branch can't be created by a logged in user):

![new_branch_anonymous](/uploads/dce42ee6a7dd7708443cdfdb56389d46/new_branch_anonymous.gif)

See merge request !3855
2016-04-29 00:33:45 +02:00
Jacob SchatzandYorick Peterse 81dafb7113 Merge branch 'sidebar-label-link' into 'master'
Updated label links to work correctly for filtering

See !3846#note_5033951

See merge request !3920
2016-04-27 19:39:12 +00:00
Rémy CoutableandRobert Speicher 0624d6a7f1 Merge branch 'fix-project-hook-delete-permissions' into 'master'
Prevent users from deleting Webhooks via API they do not own

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15576

See merge request !1959
2016-04-27 13:32:55 -04:00
Robert SpeicherandYorick Peterse 6044fd7e46 Merge branch 'rs-notes-privilege-escalation' into 'master'
Prevent privilege escalation via notes API

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15577

See merge request !1964
2016-04-27 08:43:33 +00:00
Robert SpeicherandYorick Peterse c8776b0c57 Merge branch '15579-filter-milestone-confidential-issues-api' into 'master'
Prevent information disclosure via milestone API

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15579

See merge request !1961
2016-04-26 08:39:02 +00:00
Robert SpeicherandYorick Peterse 3b83ed2125 Merge branch '15437-fix-xss-in-issue-tracker-service' into 'master'
Prevent XSS via custom issue tracker URL

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/15437

See merge request !1955
2016-04-25 21:55:52 +00:00
Robert SpeicherandYorick Peterse df1b1e58be Merge branch '15591-fix-project-leak-in-new-mr-view' into 'master'
Prevent information disclosure via new merge request page

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15591.

See merge request !1963
2016-04-25 21:53:17 +00:00
Robert SpeicherandYorick Peterse 61013f11bb Merge branch 'fix-impersonation-issue' into 'master'
Prevent privilege escalation via "impersonate" feature

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15548

See merge request !1956
2016-04-25 21:52:40 +00:00
Robert SpeicherandYorick Peterse 516900b9dc Merge branch 'fix-private-snippet-api' into 'master'
Prevent information disclosure via snippet API

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15580

See merge request !1958
2016-04-25 21:51:52 +00:00
Robert SpeicherandYorick Peterse 9cc7e37ebe Merge branch 'dev_issue_15331' into 'master'
Fixes window.opener bug

Adds `noreferrer` value to rel attribute for external links

REF: https://gitlab.com/gitlab-org/gitlab-ce/issues/15331

See merge request !1953
2016-04-25 21:49:24 +00:00
Dmitriy ZaporozhetsandYorick Peterse 44a18c64e3 Merge branch 'fix-issue-with-assignee-not-updating' into 'master'
Fixed issue with assignee object not being returned

Closes #15515

See merge request !3877
2016-04-25 21:54:55 +02:00
Rémy CoutableandYorick Peterse 2df5ea681a Merge branch 'fix/hidden-build-validation-in-ci-yaml' into 'master'
Add posibility to define a hidden job without 'script' in .gitlab-ci.yml

References #15451

/cc @ayufan 

See merge request !3849
2016-04-25 21:54:25 +02:00
Yorick Peterse a3783cde1a Merge branch 'fix-cache-invalidations' into 'master'
Fix Error 500 due to stale cache when projects are renamed or transferred

See merge request !3865
2016-04-25 21:54:09 +02:00
Rémy CoutableandYorick Peterse 8d7c63b708 Merge branch '15470-fix-unknown-license-not-shown' into 'master'
Fix license detection to detect all license files, not only known licenses

Fixes #15470.

See merge request !3878
2016-04-25 21:53:19 +02:00
Robert SpeicherandYorick Peterse 0325d26d06 Merge branch 'rs-todos-feature-spec' into 'master'
Refactor Todos feature spec to be faster and less brittle

We now only create two Todos instead of 21 when testing pagination, and
we've updated the test to be less brittle when dealing with slower CI
environments.

See merge request !3889
2016-04-25 21:53:10 +02:00
Robert SpeicherandYorick Peterse 009e2ed1c7 Merge branch '15513-fix-undefined-can-method' into 'master'
Use the `can?` helper instead of `current_user.can?`

Fixes #15513.

See merge request !3882
2016-04-25 21:52:54 +02:00
Robert SpeicherandYorick Peterse 777a8b2af5 Merge branch 'fix/cherry-pick-specs-location' into 'master'
Move cherry-pick feature specs to proper directory

Cherry pick feature specs were located in `spec/feature/project` directory while we have `spec/feature/projects`.

Later location is consistent with our namespaces (we have `Projects::` namespace, not `Project::`).

See merge request !3875
2016-04-25 19:49:39 +00:00
Rémy CoutableandYorick Peterse 76c215cbd0 Merge branch 'issue_3799' into 'master'
Allow filtering by Owned projects on dashboard page

Closes #3799 

![Screen_Shot_2016-04-15_at_9.40.52_PM](/uploads/440498c5647bda282304891307931a02/Screen_Shot_2016-04-15_at_9.40.52_PM.png)

See merge request !3762
2016-04-22 10:59:09 +02:00
Rémy CoutableandYorick Peterse 778b1f46b4 Merge branch 'rs-diff_view' into 'master'
Always read diff_view setting from the cookie

Prior, when the user had their view set to "parallel" and then visited a
merge request's changes tab _without_ passing the `view` parameter via
query string, the view would be parallel but the `Notes` class was
always instantiated with the default value from `diff_view` ("inline"),
resulting in broken markup when the form to add a line note was
dynamically inserted.

The cookie is set whenever the view is changed, so this value should
always be up-to-date.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/14557 and https://gitlab.com/gitlab-org/gitlab-ce/issues/15285

See merge request !3732
2016-04-22 10:56:04 +02:00
Robert SpeicherandYorick Peterse dd5a29e8da Merge branch 'confirmation-screen' into 'master'
Improved email confirmation UX

Closes #4228

See merge request !3184
2016-04-22 10:55:48 +02:00
Grzegorz BizonandYorick Peterse fbb819a645 Merge branch 'fix/private-labels-permissions' into 'master'
Fix vulnerability that leaks private labels and milestones

## Summary

This fixes vulnerability that leaks information about private labels and milestones because of  insecure direct object reference in issueable create service.
This affects merge requests and issues.

See https://gitlab.com/gitlab-org/gitlab-ce/issues/15439

## Fix

This MR introduces additional check that rejects labels and milestone that does not belong to the same project issue/merg request does.

## Further work

`IssuableBaseService` may benefit from encapsulating filters in separate class/module, which then may improve coherency in this class.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15439

See merge request !1954
2016-04-22 10:53:54 +02:00
Jacob SchatzandYorick Peterse c89d30ef48 Merge branch 'label-dropdown-fix' into 'master'
Fixes "create label" functionality on label dropdown

**Issue sidebar**

![label_dropdown](/uploads/2a056136fc88626530fc275ded0c2aa3/label_dropdown.gif)

**Issues page**

![label_dropdown_issues](/uploads/965fd20f5b206499e9b11a64556c5240/label_dropdown_issues.gif)



See merge request !3670
2016-04-21 22:30:41 +00:00
Yorick Peterse 583fec3d3d Merge branch '15465-fix-sort-by-due-date' into 'master'
Remove the `.distinct` when finding issues

See merge request !3858
2016-04-21 22:27:52 +00:00
Douwe MaanandYorick Peterse 059b6edaf8 Merge branch 'fix/label-filters' into 'master'
Filter labels by including ALL filter titles

Fixed query to use `AND` and not `OR`. Refactored relevant specs

See merge request !3815
2016-04-21 15:49:23 +00:00
Rémy CoutableandYorick Peterse fee23a52ff Merge branch 'issue_5838' into 'master'
Show project members only for members

fixes #5838 

See merge request !3752
2016-04-21 15:49:02 +00:00
Grzegorz BizonandYorick Peterse ad016cbd86 Merge branch 'fix/cross-project-labels-project-reference' into 'master'
Fix cross-project label ref used with invalid project

When cross-project label reference was used with invalid project reference, `nil` was assigned to project variable which later caused an exception.

Closes #15168

See merge request !3811
2016-04-21 10:26:36 +00:00
Robert SpeicherandYorick Peterse 166ef2226b Merge branch 'fix-grape-internal-allowed-action' into 'master'
Fix setting of "action" for Grape transactions

After wondering why we're not getting all the data in Grafana that I
wanted I realized I wasn't setting the "action" field properly here.

See merge request !3842
2016-04-21 10:17:33 +00:00
Robert SpeicherandYorick Peterse 82d8c74f76 Merge branch 'due-date-frontend' into 'master'
Add due date to issues

Closes: #12709

See merge request !3614
2016-04-21 10:07:02 +00:00
Yorick Peterse c0acc32199 Merge branch 'fix-mr-cherry-pick-without-merge-commit' into 'master'
Verify the MR being displayed question has a merge commit set and can be cherry-picked

See merge request !3830
2016-04-21 09:41:16 +00:00
Rémy CoutableandYorick Peterse 223c64f8b5 Merge branch 'feature/incremental-build-trace-update' into 'master'
Add incremental build trace update API

Closes #14537 

Must be merged if we want changes from gitlab-org/gitlab-ci-multi-runner!124 to work.

See merge request !3447
2016-04-21 09:23:43 +00:00
Jacob SchatzandYorick Peterse 54851c014a Merge branch 'multi-filter-labels' into 'master'
Mutliple label filter

Fixes #989 

See merge request !3438
2016-04-21 09:23:28 +00:00
Jacob SchatzandYorick Peterse 4715ab9134 Merge branch 'issue_14678' into 'master'
Refresh page according remaining todos

Fixes #14678 

See merge request !3428
2016-04-21 09:17:39 +00:00
Robert SpeicherandYorick Peterse 69821f1a01 Merge branch 'license-templates-and-api-12804' into 'master'
License templates when creating/editing a LICENSE file

Closes #12804

See merge request !3660
2016-04-20 10:50:27 +02:00
Rémy CoutableandYorick Peterse aa49124ef4 Merge branch 'feature/raw-trace-output' into 'master'
Add raw build trace output

Closes #15308, #15147

Changes in the UI:

- on finished build:

    ![raw-on-finished-build](/uploads/0e0904940db5b381ae064d49343c6508/raw-on-finished-build.png)

- on running build:

    ![raw-on-running-build](/uploads/0e4c800b68c12bdd0cbd2eea732b22ff/raw-on-running-build.png)

See merge request !3767
2016-04-20 10:49:56 +02:00
Rémy CoutableandYorick Peterse b255cbf396 Merge branch 'slack_wiki_notifications' into 'master'
add slack notifications for wiki pages

## What does this MR do?

Lets the Slack service be configured to send notifications when wiki pages are created or edited.

## Are there points in the code the reviewer needs to double check?

I'm just starting to get familiar with the Gitlab codebase and I was unsure on how to get the wiki page url to pass it to the slack message, on whether or not I needed to refactor the create/update methods for wiki pages from the controller to a service (but seemed necessary to test it better), and if I needed to add a column to the web hooks table or if the services table would have been enough. Please let me know if I should change anything and I will improve the MR, thanks for checking :)

## Why was this MR needed?

Related to #563 and fixes #4233.



See merge request !2998
2016-04-20 10:49:31 +02:00
Douglas Barbosa AlexandreandYorick Peterse c50f2e155b Fix GitHub project's link on import page when provider has a custom URL 2016-04-19 19:20:02 +02:00
P.S.V.RandYorick Peterse fd4c833367 Add support to cherry-pick any commit
Issue: https://gitlab.com/gitlab-org/gitlab-ce/issues/12785
Merge Request: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3514
2016-04-19 19:19:00 +02:00
Ben BodenmillerandYorick Peterse 8d1b82acf1 format merge request references properly 2016-04-19 19:18:56 +02:00
Robert Speicher 18a8844fa0 Merge branch '14566-confidential-issue-branches' into 'master'
Sanitize branch names for confidential issues

- When creating new branches for confidential issues, prefer a branch name like `issue-15` to `some-sensitive-issue-title-15`.
- The behaviour for non-confidential issues stays the same.

Closes #14566

See merge request !3671
2016-04-19 16:15:50 +00:00
Douwe Maan 60942bf581 Merge branch 'rs-issue-15126' into 'master'
Remove persistent XSS vulnerability in `commit_person_link` helper

Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.

Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126

See merge request !1948
2016-04-19 15:16:00 +00:00