Grzegorz BizonandYorick Peterse fbb819a645 Merge branch 'fix/private-labels-permissions' into 'master' ...

Fix vulnerability that leaks private labels and milestones

## Summary

This fixes vulnerability that leaks information about private labels and milestones because of  insecure direct object reference in issueable create service.
This affects merge requests and issues.

See https://gitlab.com/gitlab-org/gitlab-ce/issues/15439

## Fix

This MR introduces additional check that rejects labels and milestone that does not belong to the same project issue/merg request does.

## Further work

`IssuableBaseService` may benefit from encapsulating filters in separate class/module, which then may improve coherency in this class.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15439

See merge request !1954

2016-04-22 10:53:54 +02:00

..

ci

Add specs for build status helper class

2016-02-18 10:52:57 +01:00

groups

Fix specs

2016-03-20 23:26:58 +01:00

issues

Merge branch 'fix/private-labels-permissions' into 'master'

2016-04-22 10:53:54 +02:00

merge_requests

Merge branch 'fix/private-labels-permissions' into 'master'

2016-04-22 10:53:54 +02:00

milestones

Tag service specs

2015-12-09 11:55:49 +01:00

notes

Adapt tests to new testing guidelines

2016-04-12 15:43:29 +02:00

projects

Setup visibility level for project when transfering for a group

2016-04-13 15:28:10 -03:00

create_commit_builds_service_spec.rb

Don't create CI status for refs that doesn't have .gitlab-ci.yml, even if the builds are enabled

2015-12-17 16:33:47 +01:00

create_release_service_spec.rb

Tag service specs

2015-12-09 11:55:49 +01:00

create_snippet_service_spec.rb

Fix more specs

2016-03-20 23:09:33 +01:00

delete_tag_service_spec.rb

Delete tags via rugged

2016-04-15 16:05:04 +02:00

delete_user_service_spec.rb

Specs for the DeleteUserService

2016-03-15 22:19:51 +01:00

destroy_group_service_spec.rb

Tag service specs

2015-12-09 11:55:49 +01:00

event_create_service_spec.rb

Tag service specs

2015-12-09 11:55:49 +01:00

git_hooks_service_spec.rb

Tag service specs

2015-12-09 11:55:49 +01:00

git_push_service_spec.rb

Only update main language if it is not already set

2016-04-06 14:56:40 -05:00

git_tag_push_service_spec.rb

Refactor GitTagPushService and fig tags_push system event hook

2016-04-19 11:00:30 +02:00

notification_service_spec.rb

Reuse User#notification_settings_for when it's possible

2016-04-11 20:50:26 -03:00

repair_ldap_blocked_user_service_spec.rb

Code style fixes and some code simplified

2016-01-08 16:26:04 -02:00

search_service_spec.rb

Tag service specs

2015-12-09 11:55:49 +01:00

system_hooks_service_spec.rb

Merge branch 'add_username_to_user_system_hooks' of https://github.com/tbeadle/gitlabhq

2016-01-13 10:12:30 +01:00

system_note_service_spec.rb

Merge branch 'master' into feature/issue-move

2016-03-19 18:50:15 +01:00

test_hook_service_spec.rb

Tag service specs

2015-12-09 11:55:49 +01:00

todo_service_spec.rb

Mentions on confidential issues doesn't create todos for non-members

2016-03-30 18:41:21 -03:00

update_release_service_spec.rb

Tag service specs

2015-12-09 11:55:49 +01:00

update_snippet_service_spec.rb

Fix more specs

2016-03-20 23:09:33 +01:00