Marin Jankovski 8ae3112b3f Merge branch 'upload-xss-access-control' into 'master' ...

Fix note attachments XSS and access control

Replaces the reverted #1528, as proposed in https://gitlab.com/gitlab-org/omnibus-gitlab/issues/434, as discussed with @dzaporozhets and as summarized in #2032.

@marin Could you take a look at the nginx config and apply it to Omnibus once this gets merged?

See merge request !1553

2015-02-20 22:47:54 +00:00

..

admin

Merge branch 'tweet-new-project'

2015-02-15 19:03:10 -08:00

explore

Respect star ordering on explore page

2015-02-18 16:40:22 -08:00

groups

Add tests for remove group member feature in admin area

2014-10-20 13:18:07 +03:00

import

Add gitorious.org importer

2015-02-20 17:42:58 +00:00

oauth

Application admin scaffold

2015-01-17 15:40:09 -08:00

profiles

Allow users that signed up via OAuth to set their password in order to use Git over HTTP(S).

2015-02-13 14:44:42 +01:00

projects

Satisfy Rubocop.

2015-02-20 16:04:03 +01:00

application_controller.rb

Refactor sorting in project

2015-02-05 19:15:05 -08:00

confirmations_controller.rb

Try signing in the user after user confirmation is correct and redirect to dashboard, otherwise redirect to signin page

2014-10-02 14:38:26 +02:00

dashboard_controller.rb

Fix event loading with associations

2015-02-18 09:38:46 -08:00

files_controller.rb

Revert "Fix broken access control and refactor avatar upload"

2015-02-19 08:57:35 -08:00

groups_controller.rb

Fix event loading with associations

2015-02-18 09:38:46 -08:00

help_controller.rb

Remove garbage and apply wiki style

2014-06-14 15:51:07 +03:00

namespaces_controller.rb

Rubocop: no trailing newlines

2015-02-02 21:53:27 -08:00

omniauth_callbacks_controller.rb

When add new social account - redirect to accounts page and show notice message

2015-02-08 00:53:31 -08:00

passwords_controller.rb

Use ruby 1.9 hash syntax

2015-01-23 17:41:10 -08:00

profiles_controller.rb

Use shorter map() syntax

2015-02-15 20:50:53 -07:00

projects_controller.rb

Fix event loading with associations

2015-02-18 09:38:46 -08:00

registrations_controller.rb

Redirect signup page to signin page.

2015-02-05 15:56:28 +01:00

search_controller.rb

Merge pull request #7695 from coverer/search_wiki

2014-09-09 16:50:43 +03:00

sessions_controller.rb

Improve application settings and write tests

2015-01-08 09:53:35 -08:00

snippets_controller.rb

Link head panel titles to relevant root page.

2015-02-13 14:31:51 +01:00

uploads_controller.rb

Use controllers to serve uploads, with XSS prevention and access control.

2015-02-20 13:13:48 +01:00

users_controller.rb

Fix user page performance and authorization

2015-02-18 13:28:24 -08:00