Robert SpeicherandTomasz Maczukin 6de76857d1 Merge branch '17298-wiki-xss' into 'master' ...

Forbid scripting for wiki files

Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.

Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.

See merge request !1969

2016-06-14 19:45:24 +02:00

..

application_controller.rb

Add a controller test for the new 'diff_view' cookie

2016-02-05 15:40:44 +01:00

artifacts_controller.rb

Merge branch 'fix/unauthorized-access-to-build-data' into 'master'

2016-06-14 19:45:11 +02:00

avatars_controller.rb

Use @repository

2016-02-02 15:06:14 +01:00

badges_controller.rb

Merge branch 'fix/invalidate-builds-badge-cache' into 'master'

2016-03-04 13:20:49 +01:00

blame_controller.rb

Move blame group logic to dedicated class

2016-01-28 14:49:21 +01:00

blob_controller.rb

Merge branch 'master' of https://gitlab.com/gitlab-org/gitlab-ce into lazy-blobs

2016-02-01 13:51:05 +01:00

branches_controller.rb

Merge branch 'master' into diverging-branch-graphs

2015-12-03 21:53:06 -06:00

builds_controller.rb

Merge branch 'fix/unauthorized-access-to-build-data' into 'master'

2016-06-14 19:45:11 +02:00

commit_controller.rb

Merge branch 'issue_3409' into 'master'

2016-02-19 19:55:19 +01:00

commits_controller.rb

Replaces "Create merge request" link with one to the MR when one exists

2016-02-10 10:32:25 -02:00

compare_controller.rb

Replaces "Create merge request" link with one to the MR when one exists

2016-02-10 10:32:25 -02:00

deploy_keys_controller.rb

Redirect to a default path if HTTP_REFERER is not set

2015-10-20 07:45:48 -07:00

find_file_controller.rb

Merge branch 'master' of github.com:gitlabhq/gitlabhq

2016-01-07 12:56:18 +01:00

forks_controller.rb

Merge branch 'issue_13648' into 'master'

2016-03-01 12:13:32 +01:00

graphs_controller.rb

Migrate CI::Project to Project

2015-12-11 18:02:09 +01:00

hooks_controller.rb

Migrate CI::Services and CI::WebHooks to Services and WebHooks

2015-12-10 16:04:08 +01:00

imports_controller.rb

Redirect /import to project page if no importing at all and repo exists

2016-02-17 15:05:44 +01:00

issues_controller.rb

Merge branch 'visibletrap/gitlab-ce-label'

2016-02-21 21:04:31 +01:00

labels_controller.rb

Merge branch 'visibletrap/gitlab-ce-label'

2016-02-21 21:04:31 +01:00

merge_requests_controller.rb

Merge branch 'tasks' into 'master'

2016-02-22 08:47:44 +01:00

milestones_controller.rb

Merge branch 'issue_3276' into 'master'

2016-02-19 20:56:00 +01:00

network_controller.rb

Fix network graph when branch name has single quotes

2015-07-29 23:29:47 -07:00

notes_controller.rb

[WIP] Background process note logic for #3948

2016-01-28 13:04:42 -05:00

project_members_controller.rb

Fix only 20 group members showing on project member page

2015-12-09 01:43:57 +01:00

protected_branches_controller.rb

Fixed Rubocop offenses

2015-12-15 00:53:52 -02:00

raw_controller.rb

Avoid trailing 'charset=' garbage

2016-02-01 12:01:13 +01:00

refs_controller.rb

Merge branch 'master' of github.com:gitlabhq/gitlabhq

2016-01-07 12:56:18 +01:00

releases_controller.rb

Refactor release code a bit

2015-11-09 15:30:50 +01:00

repositories_controller.rb

Let gitlab-git-http-server handle archive downloads

2015-10-08 17:12:00 +02:00

runner_projects_controller.rb

Make the CI permission model simpler

2016-02-02 09:18:08 +01:00

runners_controller.rb

Make the CI permission model simpler

2016-02-02 09:18:08 +01:00

services_controller.rb

Backport JIRA service

2015-12-18 14:19:48 -06:00

snippets_controller.rb

Fix autocomplete for new issues/MRs/snippets

2016-01-15 11:29:53 +01:00

tags_controller.rb

Merge branch 'fix/13781-delete-tag-without-ajax' into 'master'

2016-03-02 14:05:38 +01:00

tree_controller.rb

Fix specs and behavior for LFS files

2015-12-18 16:14:12 +01:00

triggers_controller.rb

Make the CI permission model simpler

2016-02-02 09:18:08 +01:00

uploads_controller.rb

Only render 404 page from /public

2015-10-13 20:12:34 +03:00

variables_controller.rb

Make the CI permission model simpler

2016-02-02 09:18:08 +01:00

wikis_controller.rb

Merge branch '17298-wiki-xss' into 'master'

2016-06-14 19:45:24 +02:00