Forbid scripting for wiki files
Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.
Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.
Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.
See merge request !1969
Fix build notification on merge request page change even if the build status didn't change
## What does this MR do?
This MR contains a bugfix for #17357 which was introduced by !3998. The notification are now only shown on status changes, and not when switching between different merge requests.
## Are there points in the code the reviewer needs to double check?
Check implementation
## Why was this MR needed?
Because auf a bug introduced in !3998.
## What are the relevant issue numbers?
#17357Closes#17357
See merge request !4086
Relative Links in the Wiki Are Broken
- [ ] #16568 (!4050) Relative links in wiki are broken
- [x] Investigate issue
- [x] Implementation / Fix
- [x] Write (failing) tests for `WikiLinkFilter`
- [x] Link to `./bar` should either get rewritten correctly or left alone
- [x] Link to `./bar.md` should maybe get rewritten correctly (is left alone currently)
- [x] Link to `bar.md` should get rewritten correctly
- [x] Check if this indeed a bug
- [x] Make sure CI is green
- [x] Assign to endboss
- [x] Wait for review
- [x] Implement review feedback
- [ ] Wait for merge
See merge request !4050
Fix build notification on merge request page change even if the build status didn't change
## What does this MR do?
This MR contains a bugfix for #17357 which was introduced by !3998. The notification are now only shown on status changes, and not when switching between different merge requests.
## Are there points in the code the reviewer needs to double check?
Check implementation
## Why was this MR needed?
Because auf a bug introduced in !3998.
## What are the relevant issue numbers?
#17357Closes#17357
See merge request !4086
Fix the line code when importing PR review comments from GitHub
Pull Request Review Comments are comments on a portion of the unified diff.
Closes#17205
See merge request !4010
Merge request widget displays TeamCity build state and code coverage correctly again
## What does this MR do?
This MR contains a fix for a regression introduced in `8.7`. In former version, the TeamCity build status was always displayed correctly. In `8.7` the build state is still checked, but the UI is not updated correctly any longer.
## Are there points in the code the reviewer needs to double check?
The changes are quite simple, so please simply double check them.
## Why was this MR needed?
This MR is needed to make the TeamCity build status working again.
## What are the relevant issue numbers?
#17080
See merge request !3998
Updated spacing between notification label and button
Closes#16552
See merge request !3965
Load the "New Branch" button asynchronously
Here's how it looks like for logged in users:
And here it is for anonymous users (or when a new branch can't be created by a logged in user):
See merge request !3855
Robert Speicher
Robert SpeicherandRobert Speicher
Stan HuandRobert Speicher
Tomasz Maczukin
Douwe MaanandTomasz Maczukin
Yorick Peterse
Rémy CoutableandYorick Peterse
Jacob SchatzandYorick Peterse