Sean McGivern 1cda245cc4 Forbid scripting for wiki files ...

Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.

Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.

2016-06-14 11:28:58 +01:00

..

admin

Allow custom text on 'almost there' page

2016-06-08 19:08:53 +01:00

ci

Redirect to root path when visiting /ci

2016-03-29 08:04:17 +02:00

concerns

Merge branch 'notes-are-awardables' into 'master'

2016-06-06 16:48:35 +00:00

dashboard

Merge branch 'meinac/gitlab-ce-change_deprecated_render_usage'

2016-05-18 12:48:23 -05:00

explore

Merge branch 'master' into issue_12658

2016-03-21 23:22:21 +01:00

groups

Merge branch 'meinac/gitlab-ce-change_deprecated_render_usage'

2016-05-18 12:48:23 -05:00

import

Redirect to a default path if HTTP_REFERER is not set

2015-10-20 07:45:48 -07:00

oauth

Fix endless redirections when accessing user OAuth applications when they are disabled

2016-06-08 05:52:04 -07:00

profiles

Remove notification level fild from users, improve migrations and specs

2016-06-10 11:49:30 -03:00

projects

Forbid scripting for wiki files

2016-06-14 11:28:58 +01:00

sherlock

Added Sherlock, a custom profiling tool for GitLab

2015-11-09 14:29:10 +01:00

abuse_reports_controller.rb

Autofill abuse message text with user url. Closes #2838

2016-01-16 10:47:12 -05:00

application_controller.rb

Add workhorse controller and API helpers

2016-06-06 13:16:30 +02:00

autocomplete_controller.rb

Updated Ruby

2016-05-25 15:26:02 +01:00

confirmations_controller.rb

Improved confirmation UX

2016-04-21 20:20:09 -04:00

dashboard_controller.rb

Restrict starred projects to viewable ones

2016-05-10 18:13:52 +01:00

emojis_controller.rb

Update award_emoji test

2016-02-23 19:37:15 -06:00

groups_controller.rb

Projects on group page should be sorted by last activity instead of id/created_at

2016-04-14 11:00:24 +02:00

health_check_controller.rb

Support token header for health check token, and general cleanup of the health_check feature.

2016-05-11 17:27:08 -07:00

help_controller.rb

Simplify random user generation.

2016-04-16 16:00:30 -04:00

invites_controller.rb

Redirect to a default path if HTTP_REFERER is not set

2015-10-20 07:45:48 -07:00

jwt_controller.rb

Improve Gitlab::Auth method names

2016-06-10 14:51:16 +02:00

namespaces_controller.rb

Prevent projects to have higher visibility than groups

2016-03-10 10:38:36 -03:00

omniauth_callbacks_controller.rb

Enable Style/MethodDefParentheses rubocop cop

2016-05-30 12:08:53 +02:00

passwords_controller.rb

Allow the initial admin to set a password

2016-03-04 17:37:57 -05:00

profiles_controller.rb

Merge branch 'master' into issue_7959

2016-03-22 11:13:27 -05:00

projects_controller.rb

Allow or not merge MR with failed build

2016-06-10 14:36:54 +02:00

registrations_controller.rb

current_user.confirmed_at.present? => current_user.confirmed?

2016-05-20 13:52:42 -04:00

root_controller.rb

Implementing 'Groups View' and 'TODOs View' as options for dashboard preferences.

2016-03-24 19:59:54 +01:00

search_controller.rb

Updated based on feedback

2016-04-26 09:04:35 +01:00

sent_notifications_controller.rb

#can_unsubscribe? -> #?unsubscribable?

2016-01-11 14:23:45 +01:00

sessions_controller.rb

Merge branch 'password-min-length-placeholder' into 'master'

2016-06-08 19:48:03 +00:00

snippets_controller.rb

user routings refactor

2016-05-08 15:27:33 +07:00

uploads_controller.rb

Branded login page also in CE

2016-02-26 15:50:51 +01:00

users_controller.rb

Group the contributing calendar by day

2016-05-16 12:22:17 +01:00