Robert SpeicherandTomasz Maczukin 59d6f0476e Merge branch '17298-wiki-xss' into 'master' ...

Forbid scripting for wiki files

Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.

Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.

See merge request !1969

2016-06-14 19:07:31 +02:00

..

assets

Merge branch 'issue_15434' into 'master'

2016-04-25 16:01:24 -04:00

controllers

Merge branch '17298-wiki-xss' into 'master'

2016-06-14 19:07:31 +02:00

finders

Merge branch 'fix-private-snippet-api' into 'master'

2016-04-25 16:45:59 -04:00

helpers

Merge branch '15437-fix-xss-in-issue-tracker-service' into 'master'

2016-04-26 10:40:20 +02:00

mailers

Merge branch 'add_email_headers' into 'master'

2016-01-19 16:25:21 -05:00

models

Merge branch '15437-fix-xss-in-issue-tracker-service' into 'master'

2016-04-26 10:40:20 +02:00

services

Merge branch 'rs-notes-privilege-escalation' into 'master'

2016-04-26 16:30:16 -04:00

uploaders

Let the CI runner know about builds that this build depends on

2016-01-14 19:45:55 +01:00

validators

Blacklist 'new'

2016-01-08 10:19:22 +01:00

views

Merge branch 'fix-impersonation-issue' into 'master'

2016-04-25 16:56:33 -04:00

workers

Write to InfluxDB directly via UDP

2015-12-29 14:53:45 +01:00