Douwe MaanandRémy Coutable 2c9cd67f78 Merge branch 'rs-issue-15126' into 'master' ...

Remove persistent XSS vulnerability in `commit_person_link` helper

Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.

Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126

See merge request !1948

Signed-off-by: Rémy Coutable <remy@rymai.me>

2016-04-19 17:35:32 +02:00

..

admin

Merge branch '11489-branded-appearance-to-ce' into 'master'

2016-03-01 11:41:03 +01:00

dashboard

Merge branch 'tasks' into 'master'

2016-02-22 08:47:44 +01:00

explore

moved and refactored feature based on feedback. Also updated CHANGELOG

2016-01-27 11:23:28 +01:00

group

Fix feature step

2016-01-07 20:23:13 -05:00

profile

Merge branch 'dz-small-ui-fixes' into 'master'

2016-02-23 16:53:26 +01:00

project

Merge branch 'rs-issue-15126' into 'master'

2016-04-19 17:35:32 +02:00

shared

Merge branch '11489-branded-appearance-to-ce' into 'master'

2016-03-01 11:41:03 +01:00

snippets

Fix spec

2015-12-16 17:07:02 +01:00

abuse_reports.rb

Partly implement new UI for user page

2015-10-16 13:24:28 +02:00

groups.rb

moved and refactored feature based on feedback. Also updated CHANGELOG

2016-01-27 11:23:28 +01:00

invites.rb

Fix spec

2015-09-09 09:28:09 +01:00

search.rb

Ability to search milestones

2015-08-24 13:59:01 +03:00

snippet_search.rb

Update all should-style syntax to expect in features

2015-06-12 05:12:09 -04:00

user.rb

Change within to page.within in feature steps

2015-06-12 05:12:42 -04:00