Robert SpeicherandTomasz Maczukin 481d4f6b6d Merge branch '17298-wiki-xss' into 'master' ...

Forbid scripting for wiki files

Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.

Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.

See merge request !1969

2016-06-14 20:32:14 +02:00

..

admin

Merge branch 'fix-impersonation-issue' into 'master'

2016-04-25 21:52:40 +00:00

ci

Redirect to root path when visiting /ci

2016-03-29 08:04:17 +02:00

concerns

Merge branch 'issue_3799' into 'master'

2016-04-22 10:59:09 +02:00

dashboard

Add missing Dashboard::LabelsController

2016-03-23 12:02:15 +01:00

explore

Merge branch 'master' into issue_12658

2016-03-21 23:22:21 +01:00

groups

Remove group members check

2016-04-18 11:12:28 -03:00

import

Redirect to a default path if HTTP_REFERER is not set

2015-10-20 07:45:48 -07:00

oauth

Include GonHelper separately and remove created_at in factory

2016-04-14 07:25:27 -07:00

profiles

Make /profile/keys/new redirects to /profile/keys for back-compat

2016-04-15 09:45:58 +02:00

projects

Merge branch '17298-wiki-xss' into 'master'

2016-06-14 20:32:14 +02:00

sherlock

Added Sherlock, a custom profiling tool for GitLab

2015-11-09 14:29:10 +01:00

abuse_reports_controller.rb

Autofill abuse message text with user url. Closes #2838

2016-01-16 10:47:12 -05:00

application_controller.rb

Merge branch 'signout-rel-url' into 'master'

2016-05-11 11:00:22 +02:00

autocomplete_controller.rb

Merge branch 'master' into assign-to-issuable-opener

2016-04-15 14:38:15 +02:00

confirmations_controller.rb

Merge branch 'confirmation-screen' into 'master'

2016-04-22 10:55:48 +02:00

dashboard_controller.rb

Fix an issue causing the Dashboard/Milestones page to be blank

2016-03-23 12:02:15 +01:00

emojis_controller.rb

Update award_emoji test

2016-02-23 19:37:15 -06:00

groups_controller.rb

Projects on group page should be sorted by last activity instead of id/created_at

2016-04-14 11:00:24 +02:00

help_controller.rb

Simplify random user generation.

2016-04-16 16:00:30 -04:00

invites_controller.rb

Redirect to a default path if HTTP_REFERER is not set

2015-10-20 07:45:48 -07:00

namespaces_controller.rb

Prevent projects to have higher visibility than groups

2016-03-10 10:38:36 -03:00

omniauth_callbacks_controller.rb

Add missing proper nil and error handling to SAML login process.

2016-04-07 16:45:33 -05:00

passwords_controller.rb

Allow the initial admin to set a password

2016-03-04 17:37:57 -05:00

profiles_controller.rb

Merge branch 'master' into issue_7959

2016-03-22 11:13:27 -05:00

projects_controller.rb

Add method to return the user notification setting for a group, or a project

2016-04-08 18:46:45 -03:00

registrations_controller.rb

Merge branch 'confirmation-screen' into 'master'

2016-04-22 10:55:48 +02:00

root_controller.rb

Implementing 'Groups View' and 'TODOs View' as options for dashboard preferences.

2016-03-24 19:59:54 +01:00

search_controller.rb

Enable search for logged-out users

2016-03-01 15:57:28 +01:00

sent_notifications_controller.rb

#can_unsubscribe? -> #?unsubscribable?

2016-01-11 14:23:45 +01:00

sessions_controller.rb

Fix 2FA authentication spoofing vulnerability

2016-04-07 11:19:29 +02:00

snippets_controller.rb

Use the configured Kaminari "per page" default

2016-03-19 17:37:54 -04:00

uploads_controller.rb

Branded login page also in CE

2016-02-26 15:50:51 +01:00

users_controller.rb

Code fixes

2016-04-18 11:12:27 -03:00