Marin JankovskiandDmitriy Zaporozhets dd9d17a6e3 Merge branch 'upload-xss-access-control' into 'master' ...

Fix note attachments XSS and access control

Replaces the reverted #1528, as proposed in https://gitlab.com/gitlab-org/omnibus-gitlab/issues/434, as discussed with @dzaporozhets and as summarized in #2032.

@marin Could you take a look at the nginx config and apply it to Omnibus once this gets merged?

See merge request !1553

2015-02-20 14:49:07 -08:00

..

1_settings.rb

Add link to share via twitter to "created project" event.

2015-02-13 12:07:59 +01:00

2_app.rb

Replace backticks with Gitlab::Popen

2014-03-03 08:40:29 +01:00

3_grit_ext.rb

Remove python from installation docs

2014-01-30 19:48:47 +02:00

4_sidekiq.rb

Use the new SIDEKIQ_MEMORY_KILLER_MAX_RSS variable

2014-12-08 13:39:25 +01:00

5_backend.rb

Update code to work with gitlab_git 3

2013-10-01 17:00:28 +03:00

6_rack_profiler.rb

Hide rack profiler by default

2014-12-24 15:43:45 +02:00

7_omniauth.rb

Rubocop: no trailing newlines

2015-02-02 21:53:27 -08:00

acts_as_taggable_on_patch.rb

Rubocop: indentation fixes Yay!!!

2015-02-02 21:59:28 -08:00

backtrace_silencers.rb

init commit

2011-10-09 00:36:38 +03:00

carrierwave.rb

Rubocop: comment indentation

2015-02-02 21:34:16 -08:00

devise_async.rb

Send devise emails async

2013-10-09 15:25:31 +03:00

devise_password_length.rb.example

Add instructions for custom password length limits

2014-01-13 10:41:10 +01:00

devise.rb

Increase password reset timeout since other people trigger it when they create an account for you.

2015-01-23 10:55:12 -08:00

disable_email_interceptor.rb

Add email interceptor to prevent mail sending if email sending is disabled.

2014-10-27 13:05:50 +01:00

doorkeeper.rb

GitLab integration. Importer

2015-02-05 12:50:34 -08:00

gitlab_shell_secret_token.rb

Rubocop: no trailing newlines

2015-02-02 21:53:27 -08:00

haml.rb

Enable HAML ugly mode by default for all environments

2013-05-14 22:17:46 +03:00

inflections.rb

Add an inflector to mark "commits" as uncountable

2012-09-26 16:32:23 -04:00

kaminari_config.rb

add kaminari config with default and max per_page values

2012-09-03 04:22:49 -07:00

mime_types.rb

Register diff mime type

2012-11-22 20:22:44 +01:00

postgresql_limit_fix.rb

patch rails to ignore text limit

2012-10-10 13:17:48 +04:00

rack_attack_git_basic_auth.rb

Add more comments explaining how we block IPs

2014-12-18 11:08:11 +01:00

rack_attack.rb.example

Create one big regular expresion for Rack::Attack

2014-08-22 09:56:39 +02:00

redis-store-fix-expiry.rb

Another comment fix

2014-12-16 12:46:55 +01:00

secret_token.rb

Allow to specify secret token via environment variable.

2014-04-15 19:27:25 +01:00

session_store.rb

Merge branch 'redis_settings'

2014-08-28 15:03:22 +03:00

smtp_settings.rb.sample

Add openssl_verify_mode option to the smtp configuration example.

2015-02-05 21:49:15 -08:00

state_machine_patch.rb

Rename snippets scopes to plural names.

2014-06-04 08:37:19 +02:00

static_files.rb

Merge branch 'upload-xss-access-control' into 'master'

2015-02-20 14:49:07 -08:00

time_zone.rb

Add timezone configuration to gitlab.yml

2014-10-21 11:27:16 +02:00

wrap_parameters.rb

init commit

2011-10-09 00:36:38 +03:00