Marin JankovskiandDmitriy Zaporozhets dd9d17a6e3 Merge branch 'upload-xss-access-control' into 'master' ...

Fix note attachments XSS and access control

Replaces the reverted #1528, as proposed in https://gitlab.com/gitlab-org/omnibus-gitlab/issues/434, as discussed with @dzaporozhets and as summarized in #2032.

@marin Could you take a look at the nginx config and apply it to Omnibus once this gets merged?

See merge request !1553

2015-02-20 14:49:07 -08:00

..

application_controller.rb

Refactor issues and merge requests lists

2014-12-23 18:49:39 +02:00

avatars_controller.rb

adding avatar to project settings page added avatar removal show project avatar on dashboard, projects page, project page added rspec and feature tests added project avatar from repository new default project icon added added copying af avatar to forking of project added generated icon fixed avatar fork hound fix style fix test fix

2015-01-24 18:51:16 +01:00

blame_controller.rb

Explicitly set before_filter for ref-related controllers

2015-01-26 15:01:51 -08:00

blob_controller.rb

Rubocop: Style/AlignHash enabled

2015-02-02 21:15:44 -08:00

branches_controller.rb

Sanitize branch name and ref name

2014-11-13 16:20:43 +01:00

commit_controller.rb

Commit page: async load branches info

2015-02-03 09:10:56 -08:00

commits_controller.rb

Apply default scope to labels and remove one for notes

2015-02-05 20:29:41 -08:00

compare_controller.rb

remove auth duplication

2014-11-05 11:04:08 +02:00

deploy_keys_controller.rb

Use @project on controllers, don't call method

2014-10-19 23:36:23 +02:00

forks_controller.rb

Select namespace where to fork project

2014-11-13 22:06:19 +02:00

graphs_controller.rb

remove auth duplication

2014-11-05 11:04:08 +02:00

hooks_controller.rb

Handle web hook exception

2014-12-04 15:07:01 +02:00

imports_controller.rb

Move projects import to separate resource. Add bare repo creation to repository controller

2014-11-30 00:50:25 +02:00

issues_controller.rb

Refactor issuable list pages

2014-12-24 11:04:33 +02:00

labels_controller.rb

Apply default scope to labels and remove one for notes

2015-02-05 20:29:41 -08:00

merge_requests_controller.rb

Apply default scope to labels and remove one for notes

2015-02-05 20:29:41 -08:00

milestones_controller.rb

Restyle and refactor milestones filter

2015-01-06 12:32:04 -08:00

network_controller.rb

Explicitly set before_filter for ref-related controllers

2015-01-26 15:01:51 -08:00

notes_controller.rb

Add Markdown preview to more forms

2014-10-15 23:52:33 -05:00

protected_branches_controller.rb

Use ruby 1.9 hash syntax

2015-01-23 17:41:10 -08:00

raw_controller.rb

Rubocop: no trailing newlines

2015-02-02 21:53:27 -08:00

refs_controller.rb

Rubocop: Style/ElseAlignment enabled

2015-02-02 21:38:50 -08:00

repositories_controller.rb

Move projects import to separate resource. Add bare repo creation to repository controller

2014-11-30 00:50:25 +02:00

services_controller.rb

Try to test settings added in the service.

2015-02-12 13:02:58 -08:00

snippets_controller.rb

Sanitize snippet file name in raw headers

2014-12-12 13:28:48 +02:00

tags_controller.rb

Move all event creation to EventCreateService.

2015-02-13 12:02:58 +01:00

team_members_controller.rb

Use @project on controllers, don't call method

2014-10-19 23:36:23 +02:00

tree_controller.rb

Explicitly set before_filter for ref-related controllers

2015-01-26 15:01:51 -08:00

uploads_controller.rb

Merge branch 'upload-xss-access-control' into 'master'

2015-02-20 14:49:07 -08:00

wikis_controller.rb

Rubocop: indentation fixes Yay!!!

2015-02-02 21:59:28 -08:00