Robert SpeicherandTomasz Maczukin 6de76857d1 Merge branch '17298-wiki-xss' into 'master' ...

Forbid scripting for wiki files

Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.

Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.

See merge request !1969

2016-06-14 19:45:24 +02:00

..

admin

Merge branch 'fix-impersonation-issue' into 'master'

2016-04-25 16:55:12 -04:00

ci

Merge branch 'fix/deprecated-ci-badge-permissions' into 'master'

2016-03-02 12:08:21 +01:00

concerns

Merge branch 'visibletrap/gitlab-ce-label'

2016-02-21 21:04:31 +01:00

dashboard

Merge branch 'fix-filtered-pagination' into 'master'

2016-03-10 18:48:35 +01:00

explore

Merge branch 'fix-filtered-pagination' into 'master'

2016-03-10 18:48:35 +01:00

groups

Fix Error 500 when creating global milestones with Unicode characters

2015-12-05 00:04:44 -08:00

import

Redirect to a default path if HTTP_REFERER is not set

2015-10-20 07:45:48 -07:00

oauth

Move helpers back to original directory

2015-09-09 14:37:34 +02:00

profiles

Merge branch 'rs-improve-grace-period' into 'master'

2016-03-01 17:04:32 +01:00

projects

Merge branch '17298-wiki-xss' into 'master'

2016-06-14 19:45:24 +02:00

sherlock

Added Sherlock, a custom profiling tool for GitLab

2015-11-09 14:29:10 +01:00

abuse_reports_controller.rb

Autofill abuse message text with user url. Closes #2838

2016-01-16 10:47:12 -05:00

application_controller.rb

Obtain lease before querying LDAP

2016-03-11 13:47:49 +01:00

autocomplete_controller.rb

Update autocomplete_controller to be more readable

2015-11-22 06:04:20 -02:00

confirmations_controller.rb

Add invites controller.

2015-04-14 12:07:33 +02:00

dashboard_controller.rb

Don't pluck project IDs for events

2016-01-26 10:51:53 +01:00

groups_controller.rb

MR feedback

2016-02-09 10:10:41 -05:00

help_controller.rb

Simplify help path prefixing

2015-09-23 00:24:17 -04:00

invites_controller.rb

Redirect to a default path if HTTP_REFERER is not set

2015-10-20 07:45:48 -07:00

namespaces_controller.rb

Allow access to group from root url

2015-09-14 11:16:54 +02:00

omniauth_callbacks_controller.rb

Merge branch 'saml-decoupling' into 'master'

2016-02-19 16:45:18 +01:00

passwords_controller.rb

Use devise paranoid mode and ensure the same message is returned every time

2015-12-09 18:40:37 -06:00

profiles_controller.rb

Notify user if they cannot create projects

2015-12-05 11:32:08 -05:00

projects_controller.rb

Merge branch 'rs-emoji' into 'master'

2016-02-19 16:29:55 +01:00

registrations_controller.rb

Partially revert "Add IP check against DNSBLs at account sign-up"

2016-01-28 16:28:19 -05:00

root_controller.rb

Add user preference to view project activity and starred project activity as default dashboard

2015-09-26 08:46:05 -07:00

search_controller.rb

Add support for searching commit log messages

2015-10-28 22:34:39 -04:00

sent_notifications_controller.rb

#can_unsubscribe? -> #?unsubscribable?

2016-01-11 14:23:45 +01:00

sessions_controller.rb

Merge branch 'fix/2fa-authentication-spoofing' into 'master'

2016-04-07 17:33:47 +02:00

snippets_controller.rb

Fix raw private snippets access workflow

2015-11-25 18:16:27 -02:00

uploads_controller.rb

Merge branch '11489-branded-appearance-to-ce' into 'master'

2016-03-01 11:41:03 +01:00

users_controller.rb

Various filter fixes

2016-02-04 13:03:41 -05:00