Grzegorz BizonandRobert Speicher 8dc82011f5 Merge branch 'fix/private-labels-permissions' into 'master' ...

Fix vulnerability that leaks private labels and milestones

This fixes vulnerability that leaks information about private labels and milestones because of  insecure direct object reference in issueable create service.
This affects merge requests and issues.

See https://gitlab.com/gitlab-org/gitlab-ce/issues/15439

This MR introduces additional check that rejects labels and milestone that does not belong to the same project issue/merg request does.

`IssuableBaseService` may benefit from encapsulating filters in separate class/module, which then may improve coherency in this class.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15439

See merge request !1954

2016-04-25 16:18:16 -04:00

..

assets

Merge branch 'issue_15434' into 'master'

2016-04-25 16:01:36 -04:00

controllers

Merge branch 'fix/2fa-authentication-spoofing' into 'master'

2016-04-07 17:33:47 +02:00

finders

Merge branch 'tasks' into 'master'

2016-02-22 08:47:44 +01:00

helpers

Merge branch 'rs-issue-15126' into 'master'

2016-04-19 17:35:32 +02:00

mailers

Fix broken link in CI build notification emails

2016-02-12 14:01:27 +01:00

models

Merge branch 'fix-bad-fetch' into 'master'

2016-04-05 16:11:46 +02:00

services

Merge branch 'fix/private-labels-permissions' into 'master'

2016-04-25 16:18:16 -04:00

uploaders

Let the CI runner know about builds that this build depends on

2016-01-14 19:45:55 +01:00

validators

Re-add EmailValidator to avoid the repetition of format: { with: Devise.email_regexp }

2016-02-09 18:15:35 +01:00

views

Merge branch 'issue_15434' into 'master'

2016-04-25 16:01:36 -04:00

workers

Merge branch 'fix/gitpushservice-complexity-issue' into 'master'

2016-02-18 17:11:47 +01:00