Douwe MaanandRémy Coutable 70ada081ed Merge branch 'rs-issue-15126' into 'master' ...

Remove persistent XSS vulnerability in `commit_person_link` helper

Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.

Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126

See merge request !1948

Signed-off-by: Rémy Coutable <remy@rymai.me>

2016-04-19 17:24:13 +02:00

..

appearances_helper.rb

Branded login page also in CE

2016-02-26 15:50:51 +01:00

application_helper.rb

Merge branch 'confidential-issues' into 'master'

2016-03-18 21:03:39 +01:00

application_settings_helper.rb

Hide the link for spam logs if the Askimet is disabled

2016-02-02 11:25:44 -02:00

auth_helper.rb

Move "I should see Crowd login form" feature to a view spec

2016-02-24 17:38:13 -05:00

blob_helper.rb

Use Rails etag/cache_control helpers

2016-03-07 16:49:46 +01:00

branches_helper.rb

Default target branch to patch-n when editing file in protected branch

2015-12-08 16:42:10 +01:00

broadcast_messages_helper.rb

Allow limited Markdown in Broadcast Messages

2016-02-06 14:30:07 -05:00

button_helper.rb

Standartize buttons and fields size

2016-01-14 13:59:28 +01:00

ci_badge_helper.rb

Update badge

2015-12-11 18:02:09 +01:00

ci_status_helper.rb

Use klass instead of clazz

2016-03-15 16:24:51 +01:00

commits_helper.rb

Merge branch 'rs-issue-15126' into 'master'

2016-04-19 17:24:13 +02:00

compare_helper.rb

Move helpers back to original directory

2015-09-09 14:37:34 +02:00

dashboard_helper.rb

Move helpers back to original directory

2015-09-09 14:37:34 +02:00

diff_helper.rb

Use Gitlab::Git::DiffCollections

2016-03-03 18:38:44 +01:00

dropdowns_helper.rb

Merge branch 'dropdown-alignment-fixes' into 'master'

2016-03-29 12:12:40 +02:00

emails_helper.rb

If action link is not found, return nil.

2015-11-25 13:53:02 +01:00

events_helper.rb

Merge branch 'fix-comments-on-confidential-issues-show-activity-feed-for-non-members' into 'master'

2016-03-29 12:18:51 +02:00

explore_helper.rb

Make projects sort dropdown shared so it can be reused for other pages

2016-03-04 19:26:10 +01:00

external_wiki_helper.rb

Fixed Rubocop offenses

2015-12-15 00:53:52 -02:00

git_helper.rb

Move helpers back to original directory

2015-09-09 14:37:34 +02:00

gitlab_markdown_helper.rb

Add a PreProcessPipeline

2016-03-02 22:19:36 -05:00

gitlab_routing_helper.rb

Ensure "Remove Source Branch" button is not shown when branch is being deleted. #3583

2015-12-04 10:43:33 -05:00

graph_helper.rb

Migrate CI::Project to Project

2015-12-11 18:02:09 +01:00

groups_helper.rb

Merge branch 'issue_12658' into 'master'

2016-03-21 21:37:57 -04:00

icons_helper.rb

audit log UI update

2016-03-02 17:06:01 +00:00

issuables_helper.rb

Merge branch 'added-milestone-upcoming' into 'master'

2016-03-30 09:26:54 +02:00

issues_helper.rb

Merge branch 'feature/issue-move' into 'master'

2016-03-21 16:40:17 +01:00

labels_helper.rb

Merge branch 'fix/14505' into 'master'

2016-03-23 12:48:08 +01:00

merge_requests_helper.rb

Refactor revert_commit_link helper.

2016-02-19 13:14:54 -05:00

milestones_helper.rb

Merge branch 'fix/14505' into 'master'

2016-03-23 12:48:08 +01:00

namespaces_helper.rb

Unify new project namespace select and path input

2015-12-02 14:09:59 +01:00

nav_helper.rb

Add missing class to builds page

2016-02-18 16:16:32 -05:00

notes_helper.rb

Merge branch 'fix-mr-comment-commit-pruned' into 'master'

2016-03-30 09:35:36 +02:00

notifications_helper.rb

Fix wrong variable name

2015-11-16 13:01:34 +01:00

page_layout_helper.rb

Don't override issue page description in project layout.

2016-01-06 13:02:51 +01:00

preferences_helper.rb

Remove redundant helper method.

2015-10-17 19:16:04 +02:00

projects_helper.rb

Merge branch 'rs-issue-15126' into 'master'

2016-04-19 17:24:13 +02:00

runners_helper.rb

Migrate CI::Project to Project

2015-12-11 18:02:09 +01:00

search_helper.rb

Fix help_autocomplete alignment

2016-03-10 15:24:37 -05:00

selects_helper.rb

Merge branch 'master' into ui/dashboard-new-issue

2015-12-07 17:12:29 +01:00

snippets_helper.rb

Remove Snippet#expires_at

2016-03-05 18:12:17 -05:00

sorting_helper.rb

Show active sorting method for projects list

2016-03-04 19:27:02 +01:00

submodule_helper.rb

Move helpers back to original directory

2015-09-09 14:37:34 +02:00

tab_helper.rb

Restyle dashboard snippets visibility level tabs.

2015-10-21 11:10:09 +02:00

tags_helper.rb

Move helpers back to original directory

2015-09-09 14:37:34 +02:00

time_helper.rb

Refactor CI helpers

2015-09-29 16:26:40 +02:00

todos_helper.rb

Merge branch 'trigger-todo-for-mentions-on-commits-page' into 'master'

2016-03-18 21:23:11 +01:00

tree_helper.rb

Some updates after last code review.

2016-02-19 13:14:52 -05:00

triggers_helper.rb

Reimplement Trigger API

2015-12-11 18:02:09 +01:00

version_check_helper.rb

Move the version_check_enabled check from view to helper

2015-09-23 16:28:51 -04:00

visibility_level_helper.rb

Merge branch 'issue_12658' into 'master'

2016-03-21 21:37:57 -04:00