Douwe MaanandRémy Coutable 70ada081ed Merge branch 'rs-issue-15126' into 'master' ...

Remove persistent XSS vulnerability in `commit_person_link` helper

Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.

Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126

See merge request !1948

Signed-off-by: Rémy Coutable <remy@rymai.me>

2016-04-19 17:24:13 +02:00

..

config

Don't load all of GitLab in mail_room

2016-02-26 18:48:13 -08:00

controllers

Merge branch 'fix/link-group-permissions' into 'master'

2016-04-19 16:09:48 +02:00

factories

Merge branch 'connorshea/gitlab-ce-revoke-authorized-application' into 'master'

2016-04-15 18:07:02 +02:00

features

Merge branch 'connorshea/gitlab-ce-revoke-authorized-application' into 'master'

2016-04-15 18:07:02 +02:00

finders

Merge branch 'issue_12658' into 'master'

2016-03-21 21:37:57 -04:00

fixtures

Add support for keyword arguments in label reference method

2016-03-03 10:41:11 +01:00

helpers

Merge branch 'rs-issue-15126' into 'master'

2016-04-19 17:24:13 +02:00

initializers

Ensure Gravatar host looks like an actual host

2016-01-18 14:58:16 +01:00

javascripts

Change js-quick-submit behavior to expect the class on the form

2016-03-02 15:11:15 -05:00

lib

Merge branch 'patch/fix-ldap-unblock-user-logic' into 'master'

2016-04-07 14:12:53 -04:00

mailers

Merge branch 'feature/issue-move' into 'master'

2016-03-21 16:40:17 +01:00

models

Merge branch 'reorder-project-expire-cache' into 'master'

2016-04-15 18:05:56 +02:00

requests

Merge branch 'fix_wip_in_mr_api' into 'master'

2016-04-01 16:07:22 +02:00

routing

Remove Profile::KeysController#new action

2016-03-03 16:13:59 -05:00

services

Merge branch 'reorder-language' into 'master'

2016-04-07 16:24:48 +02:00

support

Merge branch 'issue_12658' into 'master'

2016-03-21 21:37:57 -04:00

tasks/gitlab

Merge branch 'drop_db_before_restore' into 'master'

2016-03-23 12:25:06 +01:00

views

Move "I should see Crowd login form" feature to a view spec

2016-02-24 17:38:13 -05:00

workers

Merge branch 'issues-show-performance' into 'master'

2016-03-21 16:40:54 +01:00

factories_spec.rb

Merge branch 'fix/issue-move-rewrite-uploads' into 'master'

2016-04-01 10:01:22 +02:00

rails_helper.rb

Started on the actual rspec 3 upgrade

2015-06-22 12:12:49 +02:00

spec_helper.rb

Original implementation to allow users to subscribe to labels

2016-03-15 17:25:37 +01:00

teaspoon_env.rb

teaspoon install

2015-05-28 18:22:32 -04:00