Douwe MaanandRémy Coutable 2c9cd67f78 Merge branch 'rs-issue-15126' into 'master' ...

Remove persistent XSS vulnerability in `commit_person_link` helper

Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.

Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126

See merge request !1948

Signed-off-by: Rémy Coutable <remy@rymai.me>

2016-04-19 17:35:32 +02:00

..

admin

Merge branch '11489-branded-appearance-to-ce' into 'master'

2016-03-01 11:41:03 +01:00

dashboard

Merge branch 'tasks' into 'master'

2016-02-22 08:47:44 +01:00

explore

remove public field from namespace and refactoring

2016-01-04 16:00:29 +02:00

group

Split group feature tests

2015-11-25 11:44:39 +01:00

profile

Fix tests

2015-11-03 16:39:09 +01:00

project

Merge branch 'fix/invalidate-builds-badge-cache' into 'master'

2016-03-04 13:20:49 +01:00

snippets

fix spinach features to use new button wordings

2015-10-15 17:59:17 +11:00

steps

Merge branch 'rs-issue-15126' into 'master'

2016-04-19 17:35:32 +02:00

support

Merge branch 'feature/jschatz1/sidebar-sizing' into 'master'

2016-02-26 16:46:27 +01:00

abuse_report.feature

Streamline the "Report button"

2015-09-29 21:47:01 +02:00

groups.feature

moved and refactored feature based on feedback. Also updated CHANGELOG

2016-01-27 11:23:28 +01:00

invites.feature

Add spinach tests around accepting and declining invitations.

2015-04-14 18:04:29 +02:00

search.feature

Ability to search milestones

2015-08-24 13:59:01 +03:00

snippet_search.feature

Updating to persist a params snippets variable

2014-09-05 13:30:55 -04:00

user.feature

Make all profile public

2015-08-27 13:06:14 +03:00