Douwe Maan 60942bf581 Merge branch 'rs-issue-15126' into 'master' ...

Remove persistent XSS vulnerability in `commit_person_link` helper

Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.

Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126

See merge request !1948

2016-04-19 15:16:00 +00:00

..

admin

Clear repository check columns asynchronously

2016-04-13 15:56:05 +02:00

atom

Wrap images in discussions and wikis with a link to the image source using ImageLinkFilter.

2016-04-04 19:44:07 -06:00

issues

Remove additional misuse of data-original-title attribute

2016-04-18 11:40:24 -04:00

merge_requests

Merge branch 'fix_quick_submit_missing_in_edit_merge_request' into 'master'

2016-04-12 17:15:52 +00:00

profiles

Add spec for deletion of authorized OAuth2 application

2016-04-14 07:24:58 -07:00

projects/badges

Add feature specs for list of badges page

2016-04-06 19:56:34 +02:00

security

Ensure project snippets have their own access level

2016-03-25 18:51:17 +01:00

builds_spec.rb

Merge remote-tracking branch 'origin/master' into ci-permissions

2016-02-04 13:16:48 +01:00

ci_lint_spec.rb

Allow subsequent validations in CI Linter

2016-01-11 13:37:31 +01:00

commits_spec.rb

Rename allow_guest_to_access_builds to public_builds

2016-02-04 12:57:46 +01:00

dashboard_issues_spec.rb

Fixed issue with dashboard/issues not filtering by milestone

2016-04-11 11:38:24 +01:00

dashboard_milestones_spec.rb

Add missing Dashboard::LabelsController

2016-03-23 12:02:15 +01:00

gitlab_flavored_markdown_spec.rb

Make sure the gfm helper passes the required options

2015-08-31 18:09:18 -04:00

groups_spec.rb

Add feature tag to feature specs

2015-07-06 22:39:55 -04:00

help_pages_spec.rb

Re-fix image rendering for help pages

2015-04-15 12:45:31 -04:00

issues_spec.rb

Added upload file test to new issue form

2016-04-17 12:15:45 +01:00

login_spec.rb

Allow the initial admin to set a password

2016-03-04 17:37:57 -05:00

markdown_spec.rb

Ensure correct filter order to validate with our markdown spec

2016-04-06 03:30:56 -03:00

notes_on_merge_requests_spec.rb

Do not include award emojis in issue view comment_count

2016-04-14 11:20:55 -07:00

participants_autocomplete_spec.rb

Add tests for autocomplete on a Commit

2016-04-16 07:21:28 -04:00

password_reset_spec.rb

Use devise paranoid mode and ensure the same message is returned every time

2015-12-09 18:40:37 -06:00

profile_spec.rb

Use stub_application_setting in a few more specs

2015-07-06 22:39:56 -04:00

projects_spec.rb

Updated tests

2016-04-12 13:10:43 -04:00

runners_spec.rb

Use different markdown

2016-04-19 07:39:53 -04:00

search_spec.rb

Add test to check if top right search form is not present

2016-04-13 16:43:07 -05:00

signup_spec.rb

Add acceptance test to check if the user password persists after form redisplays.

2016-04-18 12:19:11 +05:30

task_lists_spec.rb

Rename .issuable-details to .detail-page (and -header and -description)

2015-12-16 16:13:22 +01:00

triggers_spec.rb

Remove ci_ prefix from all ci related things

2015-12-11 18:02:09 +01:00

users_spec.rb

Streamline the "Report button"

2015-09-29 21:47:01 +02:00

variables_spec.rb

Remove ci_ prefix from all ci related things

2015-12-11 18:02:09 +01:00