Douwe MaanandRémy Coutable 70ada081ed Merge branch 'rs-issue-15126' into 'master' ...

Remove persistent XSS vulnerability in `commit_person_link` helper

Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.

Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126

See merge request !1948

Signed-off-by: Rémy Coutable <remy@rymai.me>

2016-04-19 17:24:13 +02:00

..

admin

Bring shared project feature tests from EE

2016-03-12 14:45:14 +01:00

dashboard

Add test for archive toggle feature

2016-03-04 19:26:10 +01:00

explore

Fix test

2016-03-04 19:27:02 +01:00

group

Updates from last code review.

2016-03-06 23:07:19 -05:00

profile

Fixed failing application settings tests

2016-03-04 09:06:07 +00:00

project

Merge branch 'issues-show-performance' into 'master'

2016-03-21 16:40:54 +01:00

snippets

fix spinach features to use new button wordings

2015-10-15 17:59:17 +11:00

steps

Merge branch 'rs-issue-15126' into 'master'

2016-04-19 17:24:13 +02:00

support

Fix Capybara 2.6.2 deprecation warnings

2016-03-15 11:03:17 -07:00

abuse_report.feature

Streamline the "Report button"

2015-09-29 21:47:01 +02:00

groups.feature

Move group activity feed to separate page for consistency with dashboard and project pages

2016-03-10 14:29:38 +01:00

invites.feature

Add spinach tests around accepting and declining invitations.

2015-04-14 18:04:29 +02:00

search.feature

Add CHANGELOG and test

2016-03-01 16:29:16 +01:00

snippet_search.feature

Updating to persist a params snippets variable

2014-09-05 13:30:55 -04:00

user.feature

Fix specs

2016-03-01 17:42:44 -05:00