Sean McGivern 1cda245cc4 Forbid scripting for wiki files ...

Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.

Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.

2016-06-14 11:28:58 +01:00

..

application_controller.rb

Project#show on projects pending deletion will 404

2016-05-28 03:14:43 -07:00

artifacts_controller.rb

Remove 'unscoped' from project builds selection

2016-06-04 00:02:40 +02:00

avatars_controller.rb

Add workhorse controller and API helpers

2016-06-06 13:16:30 +02:00

badges_controller.rb

Use default branch when displaying list of badges

2016-04-06 19:56:35 +02:00

blame_controller.rb

Move blame group logic to dedicated class

2016-01-28 14:49:21 +01:00

blob_controller.rb

Add a Blob model that wraps Gitlab::Git::Blob

2016-02-18 22:45:30 -05:00

branches_controller.rb

Update tests to match new Code tab logic

2016-06-03 10:13:40 +03:00

builds_controller.rb

CI build page UI update

2016-06-10 12:07:51 +01:00

commit_controller.rb

Rename all ci_commit[s] in application code to pipeline[s]

2016-06-03 16:27:50 +02:00

commits_controller.rb

API support for the 'since' and 'until' operators on commit requests

2016-04-29 09:26:52 +02:00

compare_controller.rb

Use @diff_notes_disabled instead of @comments_allowed

2016-05-13 17:31:58 -05:00

container_registry_controller.rb

Verify if registry is enabled in registry

2016-05-18 12:28:48 -05:00

deploy_keys_controller.rb

Project deploy keys updated UI

2016-04-25 16:26:41 +01:00

find_file_controller.rb

Enable Style/EndOfLine Rubocop style cop

2016-05-30 10:35:37 +02:00

forks_controller.rb

Use the configured Kaminari "per page" default

2016-03-19 17:37:54 -04:00

git_http_controller.rb

Improve Gitlab::Auth method names

2016-06-10 14:51:16 +02:00

graphs_controller.rb

API support for the 'since' and 'until' operators on commit requests

2016-04-29 09:26:52 +02:00

group_links_controller.rb

Use guard clause to check ability to share project

2016-04-19 12:15:56 +02:00

hooks_controller.rb

Add Admin UI to enable Wiki Page events webhook in projects

2016-05-30 16:12:50 -03:00

imports_controller.rb

removed transaction stuff

2016-05-13 13:12:21 +02:00

issues_controller.rb

Respond to .json only

2016-06-03 17:14:23 -05:00

labels_controller.rb

add :set_priorities to :authorize_admin_labels!

2016-06-06 11:59:49 -05:00

merge_requests_controller.rb

Add send_git_diff helper

2016-06-08 14:30:15 +02:00

milestones_controller.rb

Merge branch 'meinac/gitlab-ce-change_deprecated_render_usage'

2016-05-18 12:48:23 -05:00

network_controller.rb

Fix network graph when branch name has single quotes

2015-07-29 23:29:47 -07:00

notes_controller.rb

Backend awardables on comments

2016-06-06 11:03:39 +02:00

notification_settings_controller.rb

Simplify Projects::NotificationSettingsController

2016-04-12 12:10:58 -03:00

pipelines_controller.rb

Rename Ci::Commit to Ci::Pipeline and rename some of the ci_commit to pipeline

2016-06-02 16:59:04 +02:00

project_members_controller.rb

Merge branch 'meinac/gitlab-ce-change_deprecated_render_usage'

2016-05-18 12:48:23 -05:00

protected_branches_controller.rb

Change deprecated usage of rendering without response body

2016-03-16 03:16:25 +02:00

raw_controller.rb

Add workhorse controller and API helpers

2016-06-06 13:16:30 +02:00

refs_controller.rb

Make it possible to switch ref in badges view

2016-04-06 19:56:34 +02:00

releases_controller.rb

Refactor release code a bit

2015-11-09 15:30:50 +01:00

repositories_controller.rb

Add workhorse controller and API helpers

2016-06-06 13:16:30 +02:00

runner_projects_controller.rb

Make the CI permission model simpler

2016-02-02 09:18:08 +01:00

runners_controller.rb

Improve displaying validation messages for runner

2016-05-19 22:01:53 +02:00

services_controller.rb

add slack notifications for wiki pages

2016-04-20 08:25:40 +08:00

snippets_controller.rb

Ensure project snippets have their own access level

2016-03-25 18:51:17 +01:00

tags_controller.rb

Use the configured Kaminari "per page" default

2016-03-19 17:37:54 -04:00

tree_controller.rb

Fix specs and behavior for LFS files

2015-12-18 16:14:12 +01:00

triggers_controller.rb

Make the CI permission model simpler

2016-02-02 09:18:08 +01:00

uploads_controller.rb

Address feedback

2016-03-22 00:09:20 +01:00

variables_controller.rb

Project variables UI

2016-05-16 10:21:51 +01:00

wikis_controller.rb

Forbid scripting for wiki files

2016-06-14 11:28:58 +01:00