Robert SpeicherandTomasz Maczukin 934d12102f Merge branch '17298-wiki-xss' into 'master' ...

Forbid scripting for wiki files

Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.

Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.

See merge request !1969

2016-06-14 19:30:27 +02:00

..

admin

Merge branch 'fix-impersonation-issue' into 'master'

2016-04-25 16:58:52 -04:00

ci

Add runners token

2015-12-11 18:02:09 +01:00

concerns

sort milestones by due_date

2015-12-03 08:53:34 -06:00

dashboard

Fixed Rubocop offenses

2015-12-15 00:53:52 -02:00

explore

Clean up overlap between dashboard and explore.

2015-09-08 14:49:20 +01:00

groups

Fix Error 500 when creating global milestones with Unicode characters

2015-12-05 00:04:44 -08:00

import

Redirect to a default path if HTTP_REFERER is not set

2015-10-20 07:45:48 -07:00

oauth

Move helpers back to original directory

2015-09-09 14:37:34 +02:00

profiles

Redirect to a default path if HTTP_REFERER is not set

2015-10-20 07:45:48 -07:00

projects

Merge branch '17298-wiki-xss' into 'master'

2016-06-14 19:30:27 +02:00

sherlock

Added Sherlock, a custom profiling tool for GitLab

2015-11-09 14:29:10 +01:00

abuse_reports_controller.rb

fix specs

2015-11-30 16:12:31 +02:00

application_controller.rb

Add "Start a new merge request" option to every commit form

2015-11-17 18:53:56 +01:00

autocomplete_controller.rb

Update autocomplete_controller to be more readable

2015-11-22 06:04:20 -02:00

confirmations_controller.rb

Add invites controller.

2015-04-14 12:07:33 +02:00

dashboard_controller.rb

Refactor duplciate code for groups_controller.rb and slack_service/note_message.rb

2015-11-17 11:03:18 +01:00

groups_controller.rb

Refactor duplciate code for groups_controller.rb and slack_service/note_message.rb

2015-11-17 11:03:18 +01:00

help_controller.rb

Simplify help path prefixing

2015-09-23 00:24:17 -04:00

invites_controller.rb

Redirect to a default path if HTTP_REFERER is not set

2015-10-20 07:45:48 -07:00

namespaces_controller.rb

Allow access to group from root url

2015-09-14 11:16:54 +02:00

omniauth_callbacks_controller.rb

Fix rubocop warnings in app

2015-10-03 00:56:37 -05:00

passwords_controller.rb

Use devise paranoid mode and ensure the same message is returned every time

2015-12-09 18:40:37 -06:00

profiles_controller.rb

Notify user if they cannot create projects

2015-12-05 11:32:08 -05:00

projects_controller.rb

Fix after column rename

2015-12-11 18:02:10 +01:00

registrations_controller.rb

When reCAPTCHA is disabled, allow registrations to go through without a code

2015-12-29 11:13:58 +01:00

root_controller.rb

Add user preference to view project activity and starred project activity as default dashboard

2015-09-26 08:46:05 -07:00

search_controller.rb

Add support for searching commit log messages

2015-10-28 22:34:39 -04:00

sessions_controller.rb

Merge branch 'fix/2fa-authentication-spoofing' into 'master'

2016-04-07 14:39:08 -04:00

snippets_controller.rb

Fix raw private snippets access workflow

2015-11-25 18:16:27 -02:00

uploads_controller.rb

Only render 404 page from /public

2015-10-13 20:12:34 +03:00

users_controller.rb

Refactor UsersController to not kill the database

2015-11-18 13:05:45 +01:00