Fix privilege escalation issue with OAuth external users
Related to https://gitlab.com/gitlab-org/gitlab-ce/issues/19312
This MR fixes a privilege escalation issue, where manually set external users would be reverted back to internal users if they logged in via OAuth and that provider was not in the `external_providers` list.
/cc @douwe
See merge request !1975
(cherry picked from commit 5e6342b7ac)
Check if GitHub rate limite API was reached before update Webhooks
## What does this MR do?
Checks if the job needs to sleep, and wait for the rate limit to be reseted before update each Webhook.
## Are there points in the code the reviewer needs to double check?
No.
## Why was this MR needed?
The import process can fail if the API rate limit was reached during the import process.
## What are the relevant issue numbers?
https://gitlab.com/gitlab-org/gitlab-ce/issues/17498
## Screenshots (if relevant)
Not relevant.
See merge request !4509
Adjust the SAML control flow to allow LDAP identities to be added to an existing SAML user.
It correctly lets an existing SAML user to add their LDAP identity automatically at login.
A customer had issues with the `auto_link_ldap_user` feature. The flow was not working if there was an account with a SAML identity, but no LDAP identity. GitLab would pick up the correct LDAP person, but due to the order of the flow, that LDAP person was never associated with the user.
Fixes#17346
/cc @dblessing @balameb @stanhu
See merge request !4498
Fix serious performance bug with rendering Markdown with InlineDiffFilter
Nokogiri's `node.replace` was being unnecessarily called for every text node in
the document due to a comparison bug. The code previously was comparing the
HTML representation of the full document against the text node, which would
always fail. Fix the comparison to just compare the modified text.
Closes#18011
See merge request !4392
Add Application Setting to configure Container Registry token expire delay (default 5min)
This adds an option to configure Container Registry token expire delay. The default is set to 5mins (something that is also used by Docker Hub).
What is left:
* [x] Write test to check the expire_delay
Fixes: https://gitlab.com/gitlab-org/gitlab-ce/issues/17890
@stanhu I think that this should land in patch release of 8.8.
See merge request !4364
Fix 404 page when viewing TODOs that contain milestones or labels in different projects
A user viewing the TODOs page will see a 404 if there are mentioned milestones or labels in multiple different projects. This is likely a caching bug and only occurs
when Markdown rendering occurs across multiple projects, which is why it's so tricky to reproduce. This is what I think is happening:
1. LabelReferenceFilter#references_in encounters label ~X for ProjectA and finds the label in the DB as id = 1.
2. LabelReferenceFilter.references_in yields [1, 'X', nil, ...]
3. Since project_ref is nil, AbstractReferenceFilter#project_from_ref_cache caches nil => ProjectA.
4. LabelReferenceFilter#references_in encounters label ~Y for ProjectB and finds the label in the DB as id = 2.
5. LabelReferenceFilter.references_in yields [2, 'Y', nil, ...]
6. AbstractReferenceFilter#project_from_ref_cache lookups nil and returns ProjectA. It was supposed to be ProjectB.
7. A is the wrong project, so the label lookup fails.
This MR expands the `project_ref` to the right value as soon as we have it to avoid this caching bug.
Closes#17898
See merge request !4312
Fix concurrent request when updating build log in browser
If you have a slow internet connection the trace will not be updated correctly. We need to check if our request is the latest one.
Fixes: https://gitlab.com/gitlab-org/gitlab-ce/issues/17535
See merge request !4183
Fix Error 500 in CI charts by gracefully handling commits with no durations
## What does this MR do?
In the CI charts, this MR reports the duration of a commit to 0 if it is `nil`.
## Are there points in the code the reviewer needs to double check?
Should we omit this commit from the chart or set it to some other value?
## Why was this MR needed?
We were getting an Error 500 here: https://gitlab.com/gitlab-org/gitlab-ce/graphs/master/ci
## What are the relevant issue numbers?
#17730
See merge request !4245
Since we eager load everything in lib/ putting ERB code in .rb files
will result in syntax errors. By moving the templates to
./generator_templates we can work around this.
Fixed advice on invalid permissions on upload path
When running the checks, my upload path has wrong permissions, the advice could not fix it because it does not change the permission of this directory (only sub-directories).
```
Uploads directory setup correctly? ... no
Try fixing it:
sudo find /home/git/gitlab/public/uploads -type d -not -path /home/git/gitlab/public/uploads -exec chmod 0700 {} \;
For more information see:
doc/install/installation.md in section "GitLab"
Please fix the error above and rerun the checks.
```
Executing this instead fixed the error :
```
sudo chmod 700 /home/git/gitlab/public/uploads
```
See merge request !2948
Added helper methods for database migrations
These helpers can ultimately be used to write migrations that don't
require downtime.
See #15464 for more information.
See merge request !3860
Add container registry support
Tasks:
- [x] Merge docker/distribution authentication service: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3787
- [x] Implement Docker Registry API
- [x] Show a list of docker images in GitLab
- [x] Remove registry repository on project deletion
- [x] Support project rename, move and namespace rename
- [x] Use token when connecting the registry
- [x] Allow to delete images from GitLab
- [x] Support pushing from GitLab CI (gitlab-ci-token / $CI_BUILD_TOKEN)
- [x] Support GitLab Runner pulling for public repositories
- [ ] Support GitLab Runner pulling for private repositories
- [x] Add tests for Docker Registry API
- [x] Add tests for a views
- [x] Make texts nicer
- [x] Implement a backup support
- [ ] Create administration documentation https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/4141
- [ ] Create user documentation
See merge request !4040
Douwe MaanandRobert Speicher
Douwe MaanandTomasz Maczukin
Stan HuandYorick Peterse
Robert SpeicherandYorick Peterse
Jacob SchatzandYorick Peterse
Achilleas PipinellisandYorick Peterse
Jeroen van Baarsen
Grzegorz Bizon
Rémy Coutable
JazzandLudovic Perrine
Rubén Dávila
Kamil Trzciński
Felipe Artur
James Lopez
Sean McGivern