Dmitriy Zaporozhets bf7932bd06 Merge branch 'dir-traversal' into 'master' ...

Fix directory traversal vulnerabilities

Fixes gitlab/gitlab-ee#272.

As @joern mentions:

> This is not exploitable via the front-end nginx. But nevertheless this issue should be addressed.

See merge request !1760

2015-04-14 13:07:27 +00:00

..

admin

Merge branch 'skip-email-reconfirmation' into 'master'

2015-04-13 13:44:56 +00:00

dashboard

Move group leave action from dashboard/groups to groups/group_members.

2015-03-15 13:52:28 +01:00

explore

Use same constant for amount of items per page

2015-03-12 15:37:00 -07:00

groups

Move group leave action from dashboard/groups to groups/group_members.

2015-03-15 13:52:28 +01:00

import

Allow projects to be imported into namespaces user is master of.

2015-04-06 14:50:43 +02:00

oauth

Application admin scaffold

2015-01-17 15:40:09 -08:00

profiles

Allow user to choose which email to be public

2015-04-14 19:42:48 +08:00

projects

Merge branch 'public-deploy-keys' into 'master'

2015-04-13 09:08:13 +00:00

application_controller.rb

Use \A and \z in regexes instead of ^ and $.

2015-04-10 18:31:07 +02:00

autocomplete_controller.rb

Add autocomplete controller

2015-03-26 19:06:19 -07:00

confirmations_controller.rb

Try signing in the user after user confirmation is correct and redirect to dashboard, otherwise redirect to signin page

2014-10-02 14:38:26 +02:00

dashboard_controller.rb

Use same constant for amount of items per page

2015-03-12 15:37:00 -07:00

groups_controller.rb

Move group members index from /members to /group_members.

2015-03-15 13:51:11 +01:00

help_controller.rb

Add explanation to HelpController#clean_path_info.

2015-04-14 13:07:15 +02:00

namespaces_controller.rb

Don't leak private group existence by redirecting from namespace controller to group controller.

2015-03-24 15:55:12 +01:00

omniauth_callbacks_controller.rb

When add new social account - redirect to accounts page and show notice message

2015-02-08 00:53:31 -08:00

passwords_controller.rb

Use ruby 1.9 hash syntax

2015-01-23 17:41:10 -08:00

profiles_controller.rb

Allow user to choose which email to be public

2015-04-14 19:42:48 +08:00

projects_controller.rb

Update html-pipeline and emoji

2015-03-11 16:05:01 -07:00

registrations_controller.rb

Redirect signup page to signin page.

2015-02-05 15:56:28 +01:00

search_controller.rb

Only trigger actual search if a search string is present

2015-03-19 10:50:34 +01:00

sessions_controller.rb

Upon successful login, clear reset_password_token field

2015-04-08 16:06:56 -04:00

snippets_controller.rb

Merge branch 'master' into fix-restricted-visibility

2015-03-14 10:49:11 -06:00

uploads_controller.rb

Reject access to group/project avatar if the user doesn't have access.

2015-03-10 17:13:02 +01:00

users_controller.rb

Merge branch 'userpage-activity-scroll'

2015-03-23 09:45:40 -07:00