Sean McGivern 1cda245cc4 Forbid scripting for wiki files ...

Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.

Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.

2016-06-14 11:28:58 +01:00

..

assets

Merge branch 'fix-bulk-assign-labels' into 'master'

2016-06-13 15:57:38 +00:00

controllers

Forbid scripting for wiki files

2016-06-14 11:28:58 +01:00

finders

Project members with guest role can't access confidential issues

2016-06-13 19:32:00 -03:00

helpers

Merge branch '18377-cherry-pick-crashes-when-choosing-a-tag' into 'master'

2016-06-13 12:46:29 +00:00

mailers

New confirmation email 🔥

2016-05-25 16:56:06 -04:00

models

Merge branch 'confidential-issues-in-private-projects' into 'master'

2016-06-14 09:35:18 +00:00

services

Merge branch 'issue_3359_2' into 'master'

2016-06-13 11:52:39 +00:00

uploaders

Remove reduntant move_to_store override

2016-03-30 12:50:19 +02:00

validators

Allow webhooks URL to have leading and trailing spaces

2016-02-26 14:34:06 -05:00

views

Merge branch 'confidential-issues-in-private-projects' into 'master'

2016-06-14 09:35:18 +00:00

workers

Update repository_import_worker.rb

2016-06-02 21:48:27 -04:00