Robert SpeicherandRobert Speicher 0c0854c86a Merge branch 'devise_paranoid_mode' into 'master' ...

Enable Devise paranoid mode and ensure the returned message is the same
every time. This will prevent user enumeration (low impact). 

Prior to this change a user could type an email in the password reset
field and if the email didn't exist it returned an error. If the email
was valid it returned a message saying the forgot password link had been
emailed. After this change the user will receive a message that if the
email is in our database the reset link will be emailed. 

I also changed the throttle mechanism so it still works the same but
now returns the exact same message as above. Previously it would say
'You've already sent a request. Wait a few minutes'. This also allows
user enumeration, although it requires a double-check.

Related to https://dev.gitlab.org/gitlab/gitlabhq/issues/2624

See merge request !2044

2015-12-09 20:59:14 -05:00

..

1_settings.rb

Merge branch 'expire-application-settings-startup' of https://gitlab.com/stanhu/gitlab-ce

2015-11-30 11:54:44 -05:00

2_app.rb

Replace all usages of git command with configurable binary path

2015-11-03 17:11:09 -05:00

4_ci_app.rb

remove gitlab_ci config

2015-09-10 13:42:41 +03:00

5_backend.rb

Warn when gitlab-shell version doesn't match requirement.

2015-04-06 14:02:49 +02:00

active_record_query_trace.rb

Added active_record_query_trace

2015-10-15 12:05:01 +02:00

attr_encrypted_no_db_connection.rb

Fix.

2015-05-15 15:32:49 +02:00

backtrace_silencers.rb

init commit

2011-10-09 00:36:38 +03:00

bullet.rb

Added Bullet to the Gemfile

2015-10-15 12:05:01 +02:00

carrierwave.rb

Rubocop: comment indentation

2015-02-02 21:34:16 -08:00

connection_fix.rb

Groundwork for merging CI into CE

2015-08-25 18:42:46 -07:00

cookies_serializer.rb

Groundwork for merging CI into CE

2015-08-25 18:42:46 -07:00

default_url_options.rb

Groundwork for merging CI into CE

2015-08-25 18:42:46 -07:00

devise_async.rb

Send devise emails async

2013-10-09 15:25:31 +03:00

devise_password_length.rb.example

Add instructions for custom password length limits

2014-01-13 10:41:10 +01:00

devise.rb

Merge branch 'devise_paranoid_mode' into 'master'

2015-12-09 20:59:14 -05:00

disable_email_interceptor.rb

Revert "Allow to configure smtp and sendmail in gitlab.yml"

2015-05-06 17:39:18 +03:00

doorkeeper.rb

retrieving oauth token with LDAP credentials

2015-08-31 15:10:01 +03:00

gitlab_shell_secret_token.rb

Allow to configure gitlab_shell_secret location

2015-05-16 21:46:06 +02:00

haml.rb

Enable HAML ugly mode by default for all environments

2013-05-14 22:17:46 +03:00

inflections.rb

Remove inflector rule that makes commits uncountable

2015-11-03 11:36:20 +01:00

kaminari_config.rb

add kaminari config with default and max per_page values

2012-09-03 04:22:49 -07:00

mime_types.rb

Add Markdown to Mime types

2015-04-15 12:25:24 -04:00

omniauth.rb

Merge branch 'master' into ci-and-ce-sitting-in-a-tree-k-i-s-s-i-n-g

2015-08-26 17:53:31 -07:00

postgresql_limit_fix.rb

patch rails to ignore text limit

2012-10-10 13:17:48 +04:00

public_key.rb

Fix typo.

2015-03-20 16:13:03 -07:00

rack_attack_git_basic_auth.rb

Add more comments explaining how we block IPs

2014-12-18 11:08:11 +01:00

rack_attack.rb.example

Groundwork for merging CI into CE

2015-08-25 18:42:46 -07:00

rack_lineprof.rb

Fixed Rubocop styling issues

2015-10-15 12:05:01 +02:00

secret_token.rb

Groundwork for merging CI into CE

2015-08-25 18:42:46 -07:00

session_store.rb

Merge branch 'session_expire_delay_cannot_be_nil' into 'master'

2015-11-24 21:28:00 -05:00

sherlock.rb

Added Sherlock, a custom profiling tool for GitLab

2015-11-09 14:29:10 +01:00

sidekiq.rb

Groundwork for merging CI into CE

2015-08-25 18:42:46 -07:00

smtp_settings.rb.sample

Add a note that changing example configuration files requires changing omnibus-gitlab.

2015-06-11 15:11:37 +02:00

static_files.rb

Groundwork for merging CI into CE

2015-08-25 18:42:46 -07:00

time_zone.rb

Add timezone configuration to gitlab.yml

2014-10-21 11:27:16 +02:00

wrap_parameters.rb

init commit

2011-10-09 00:36:38 +03:00