Douwe MaanandRémy Coutable 2c9cd67f78 Merge branch 'rs-issue-15126' into 'master' ...

Remove persistent XSS vulnerability in `commit_person_link` helper

Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.

Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126

See merge request !1948

Signed-off-by: Rémy Coutable <remy@rymai.me>

2016-04-19 17:35:32 +02:00

..

badges

Merge branch 'fix/invalidate-builds-badge-cache' into 'master'

2016-03-04 13:20:49 +01:00

builds

Merge branch 'ci/remove-builds' into 'master'

2016-02-19 18:22:49 +01:00

commits

Merge branch 'rs-issue-15126' into 'master'

2016-04-19 17:35:32 +02:00

issues

Merge branch 'fix-failing-issue-tests' into 'master'

2016-02-23 11:28:48 +01:00

merge_requests

Merge branch 'issue_3409' into 'master'

2016-02-19 19:55:19 +01:00

source

Merge branch 'dz-small-ui-fixes' into 'master'

2016-02-23 16:53:26 +01:00

active_tab.rb

Fix consistency issue in sidebars of Project and Group Settings.

2015-06-24 18:05:16 +02:00

archived.rb

Update all should-style syntax to expect in features

2015-06-12 05:12:09 -04:00

create.rb

Moves star code to a class

2015-12-23 20:36:29 -05:00

deploy_keys.rb

Change within to page.within in feature steps

2015-06-12 05:12:42 -04:00

fork.rb

Merge branch 'fix/project-forks-page' into 'master'

2016-02-19 16:29:41 +01:00

forked_merge_requests.rb

Fix broken spec.

2016-01-20 00:17:21 -05:00

graph.rb

Add tests and changelog item for language graphs

2015-12-08 02:38:59 +01:00

hooks.rb

Fix spec

2015-12-04 07:13:28 -08:00

merge_requests.rb

Merge branch 'fix-failing-issue-tests' into 'master'

2016-02-23 11:28:48 +01:00

network_graph.rb

Fix network graph when branch name has single quotes

2015-07-29 23:29:47 -07:00

project_find_file.rb

Merge branch 'master' of github.com:gitlabhq/gitlabhq

2016-01-07 12:56:18 +01:00

project_milestone.rb

Merge branch 'issue_13621' into 'master'

2016-03-01 12:13:04 +01:00

project_shortcuts.rb

Add shortcut for project activity page

2015-07-08 12:43:46 +02:00

project.rb

Fixed Rubocop offenses

2015-12-15 00:53:52 -02:00

redirects.rb

Fix rubocop warnings in features

2015-10-03 19:59:54 -05:00

services.rb

Backport JIRA service

2015-12-18 14:19:48 -06:00

snippets.rb

Rename .issuable-details to .detail-page (and -header and -description)

2015-12-16 16:13:22 +01:00

star.rb

spinach tests will pass now

2015-12-23 12:26:50 -05:00

team_management.rb

Refactor group members tests a bit

2015-11-25 10:24:29 +01:00

wiki.rb

Merge branch 'dz-small-ui-fixes' into 'master'

2016-02-23 16:53:26 +01:00