Robert SpeicherandTomasz Maczukin 59d6f0476e Merge branch '17298-wiki-xss' into 'master' ...

Forbid scripting for wiki files

Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.

Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.

See merge request !1969

2016-06-14 19:07:31 +02:00

..

admin

Merge branch 'fix-impersonation-issue' into 'master'

2016-04-25 16:56:33 -04:00

ci

Limit guest access builds

2016-02-08 20:27:24 +01:00

concerns

Merge branch 'fix-mr-diff-edit-button' into 'master'

2016-01-21 23:40:14 -08:00

dashboard

Fixed Rubocop offenses

2015-12-15 00:53:52 -02:00

explore

remove public field from namespace and refactoring

2016-01-04 16:00:29 +02:00

groups

Fix Error 500 when creating global milestones with Unicode characters

2015-12-05 00:04:44 -08:00

import

Redirect to a default path if HTTP_REFERER is not set

2015-10-20 07:45:48 -07:00

oauth

Move helpers back to original directory

2015-09-09 14:37:34 +02:00

profiles

Fixed codestyle and added 2FA documentation

2015-12-24 19:01:30 -02:00

projects

Merge branch '17298-wiki-xss' into 'master'

2016-06-14 19:07:31 +02:00

sherlock

Added Sherlock, a custom profiling tool for GitLab

2015-11-09 14:29:10 +01:00

abuse_reports_controller.rb

Merge branch 'abuse-autofill-message' into 'master'

2016-01-16 12:07:12 -05:00

application_controller.rb

Merge branch 'issue_3945' into 'master'

2016-01-20 16:56:13 -05:00

autocomplete_controller.rb

Update autocomplete_controller to be more readable

2015-11-22 06:04:20 -02:00

confirmations_controller.rb

Add invites controller.

2015-04-14 12:07:33 +02:00

dashboard_controller.rb

Refactor duplciate code for groups_controller.rb and slack_service/note_message.rb

2015-11-17 11:03:18 +01:00

groups_controller.rb

Refactor duplciate code for groups_controller.rb and slack_service/note_message.rb

2015-11-17 11:03:18 +01:00

help_controller.rb

Simplify help path prefixing

2015-09-23 00:24:17 -04:00

invites_controller.rb

Redirect to a default path if HTTP_REFERER is not set

2015-10-20 07:45:48 -07:00

namespaces_controller.rb

Allow access to group from root url

2015-09-14 11:16:54 +02:00

omniauth_callbacks_controller.rb

Merge branch 'rs-ldap-user' into 'master'

2016-01-31 19:26:59 -05:00

passwords_controller.rb

Use devise paranoid mode and ensure the same message is returned every time

2015-12-09 18:40:37 -06:00

profiles_controller.rb

Notify user if they cannot create projects

2015-12-05 11:32:08 -05:00

projects_controller.rb

Limit guest access builds

2016-02-08 20:27:24 +01:00

registrations_controller.rb

Merge branch 'feature/check-against-rbl-only' into 'master'

2016-01-20 14:25:40 -05:00

root_controller.rb

Add user preference to view project activity and starred project activity as default dashboard

2015-09-26 08:46:05 -07:00

search_controller.rb

Add support for searching commit log messages

2015-10-28 22:34:39 -04:00

sent_notifications_controller.rb

#can_unsubscribe? -> #?unsubscribable?

2016-01-11 14:23:45 +01:00

sessions_controller.rb

Merge branch 'fix/2fa-authentication-spoofing' into 'master'

2016-04-07 14:42:16 -04:00

snippets_controller.rb

Fix raw private snippets access workflow

2015-11-25 18:16:27 -02:00

uploads_controller.rb

Only render 404 page from /public

2015-10-13 20:12:34 +03:00

users_controller.rb

remove public field from namespace and refactoring

2016-01-04 16:00:29 +02:00