Douwe MaanandRobert Speicher 142324ac13 Merge branch '19312-confidential-issue' into 'master' ...

Fix privilege escalation issue with OAuth external users

Related to https://gitlab.com/gitlab-org/gitlab-ce/issues/19312

This MR fixes a privilege escalation issue, where manually set external users would be reverted back to internal users if they logged in via OAuth and that provider was not in the `external_providers` list.

/cc @douwe

See merge request !1975
(cherry picked from commit 5e6342b7ac)

2016-06-30 14:38:49 -04:00

..

backend

Merge branch 'pmq20/gitlab-ce-psvr/change-head' into 'master'

2016-04-15 16:44:21 +00:00

badge

Extend build status badge, add html/markdown methods

2016-04-06 19:56:34 +02:00

bitbucket_import

Merge branch 'fix/import-data-issue' into 'master'

2016-05-19 13:06:36 -05:00

ci/build/artifacts

Add method that calculates total size for artifacts subfolder

2016-01-20 21:55:13 +01:00

diff

Show a notice for diffs that are too large

2016-03-18 12:30:46 +01:00

email

Added & use Gitlab::Routing for URL helpers

2016-04-01 11:13:48 +02:00

fogbugz_import

Merge branch 'fix/import-data-issue' into 'master'

2016-05-19 13:06:36 -05:00

gfm

Remove reduntant move_to_store override

2016-03-30 12:50:19 +02:00

git

Fire update hook from GitLab

2015-11-30 18:36:34 +02:00

github_import

Merge branch 'gh-review-comments' into 'master'

2016-05-05 19:35:54 +02:00

gitlab_import

Merge branch 'fix/gitlab-import-data' into 'master'

2016-05-19 13:07:27 -05:00

gitorious_import

Fixed Rubocop offenses

2015-12-15 00:53:52 -02:00

google_code_import

Merge branch 'fix/import-data-issue' into 'master'

2016-05-19 13:06:36 -05:00

graphs

Refactor commits graph

2014-09-29 12:05:17 +03:00

ldap

Unblocks user when active_directory is disabled and it can be found

2016-04-05 16:34:31 -03:00

lfs

Recursivity needed if a fork is a fork of a fork.

2015-12-04 12:32:13 +01:00

markdown

Prevent circular reference error in Banzai

2016-01-14 11:30:28 +01:00

metrics

Count the number of SQL queries per transaction

2016-04-18 14:53:13 +02:00

middleware

Revert "Revert "Merge branch 'support-go-subpackages' into 'master' ""

2016-03-12 21:05:23 +00:00

o_auth

Merge branch '19312-confidential-issue' into 'master'

2016-06-30 14:38:49 -04:00

saml

Better control flow and added guard clause.

2016-04-11 17:25:18 -05:00

sherlock

Added total query time to Sherlock

2015-11-24 10:57:21 +01:00

sidekiq_middleware

Use SIGKILL by default in Sidekiq::MemoryKiller

2015-05-13 17:09:12 +02:00

sql

Fix UNION syntax for MySQL

2015-11-18 13:31:18 +01:00

access.rb

Improve description of branch protection levels.

2015-05-13 09:41:55 +02:00

akismet_helper.rb

Memoize Akismet client initialization on AkismetHelper

2016-02-02 11:25:44 -02:00

app_logger.rb

Dry admin logs.

2014-10-06 00:14:46 +02:00

asciidoc.rb

Fix relative links in other markup formats

2016-02-12 17:20:59 +01:00

auth.rb

Session API: Use case-insensitive authentication like in UI

2014-10-30 18:29:18 +02:00

bitbucket_import.rb

Fix specs.

2015-02-24 15:07:24 +01:00

blame.rb

Load all blob data when highlighting content for git-blame.

2016-02-11 18:30:05 -05:00

build_data_builder.rb

Suppress e-mails on failed builds if allow_failure is set

2016-01-07 10:45:39 -08:00

closing_issue_extractor.rb

Allow invalid URLs in closing pattern

2015-12-02 18:48:39 +01:00

color_schemes.rb

Add count to Themes and ColorSchemes

2015-08-26 11:30:38 -07:00

config_helper.rb

Make app works with strong params

2014-06-26 23:24:17 +03:00

contributions_calendar.rb

Simplify ContributionsCalendar#starting_year and #starting_month

2016-01-01 22:11:34 -05:00

contributor.rb

Move lib/gitlab/contributors to its correct path

2015-04-09 15:34:55 -04:00

current_settings.rb

Include GonHelper separately and remove created_at in factory

2016-04-14 07:25:27 -07:00

database.rb

Fix undefined method postgresql? during migration

2016-02-15 14:13:47 -05:00

devise_failure.rb

Use a custom Devise failure app to handle unauthenticated .zip requests

2016-03-08 23:49:30 -05:00

exclusive_lease.rb

clean up ExclusiveLease

2016-04-13 13:12:05 +03:00

force_push_check.rb

Replace all usages of git command with configurable binary path

2015-11-03 17:11:09 -05:00

git_access_status.rb

Rubocop enabled for: Use spaces inside hash literal braces

2015-02-02 20:36:54 -08:00

git_access_wiki.rb

Rename abilities to correspond contoller/model action names

2015-06-26 15:55:56 +02:00

git_access.rb

Add support for git lfs.

2015-11-16 12:39:13 +01:00

git_logger.rb

Dry admin logs.

2014-10-06 00:14:46 +02:00

git_post_receive.rb

Back-porting PostReceive refactor made for EE 🍺

2016-03-17 00:24:12 -03:00

git_ref_validator.rb

Replace all usages of git command with configurable binary path

2015-11-03 17:11:09 -05:00

git.rb

Freeze the expression instead of the literal

2016-02-05 08:39:44 +01:00

gitorious_import.rb

Define GITORIOUS_HOST only once

2015-06-10 01:31:27 -04:00

gon_helper.rb

Merge branch 'revert-sentry-js' into 'master'

2016-04-21 12:30:13 +00:00

highlight.rb

Merge branch 'master' of https://gitlab.com/gitlab-org/gitlab-ce into lazy-blobs

2016-02-01 13:51:05 +01:00

identifier.rb

Use project.commit convenience method.

2015-04-24 12:29:36 +02:00

import_formatter.rb

Fix bug where only the first 15 Bitbucket issues would be imported.

2015-09-01 08:50:20 -07:00

import_sources.rb

FogBugz project import

2015-09-08 20:23:01 -04:00

import_url.rb

updated migration based on testing findings

2016-04-14 12:03:45 +02:00

incoming_email.rb

Improve and finish the fallback to the In-Reply-To and References header for the reply-by-email feature

2016-03-25 13:05:15 +01:00

issues_labels.rb

remove feature label

2014-10-31 17:22:16 -07:00

key_fingerprint.rb

Simplify regex.

2015-04-14 15:58:28 +02:00

logger.rb

Dry admin logs.

2014-10-06 00:14:46 +02:00

markup_helper.rb

markup_helper: detect .mkd and .mkdn as markdown

2015-08-12 15:29:15 -04:00

metrics.rb

Merge branch 'fix-grape-internal-allowed-action' into 'master'

2016-04-21 10:17:33 +00:00

note_data_builder.rb

Refactor and expose only Gitlab::UrlBuilder.build(record)

2016-04-13 16:07:04 +02:00

other_markup.rb

Fix relative links in other markup formats

2016-02-12 17:20:59 +01:00

popen.rb

Style/RedundantReturn enabled

2015-03-24 18:35:57 -07:00

production_logger.rb

Dry admin logs.

2014-10-06 00:14:46 +02:00

project_search_results.rb

Restrict access to confidential issues on search results

2016-03-17 20:55:59 -03:00

push_data_builder.rb

Using single builder for push and tag events

2016-04-19 11:00:30 +02:00

recaptcha.rb

reCAPTCHA is configurable through Admin Settings, no reload needed.

2015-12-28 18:50:29 -02:00

redis.rb

Redis configuration consistency

2016-04-13 20:57:19 +03:00

reference_extractor.rb

Improvements in issue move feaure (refactoring)

2016-03-19 18:46:01 +01:00

regex.rb

Merge branch 'master' of gitlab.com:gitlab-org/gitlab-ce into fix/atom-url-issue

2016-02-02 15:15:59 +01:00

repository_check_logger.rb

Rename almost all the things

2016-04-06 13:47:05 +02:00

routing.rb

Added & use Gitlab::Routing for URL helpers

2016-04-01 11:13:48 +02:00

search_results.rb

Restrict access to confidential issues on search results

2016-03-17 20:55:59 -03:00

seeder.rb

Migrate mailers to ActiveJob

2015-11-26 17:03:43 +02:00

sherlock.rb

Only load rblineprof when actually needed

2015-11-09 15:54:13 +01:00

sidekiq_logger.rb

Dry admin logs.

2014-10-06 00:14:46 +02:00

snippet_search_results.rb

Refactor Gitlab::SnippetSearchResults

2016-03-11 15:25:22 -05:00

themes.rb

Add count to Themes and ColorSchemes

2015-08-26 11:30:38 -07:00

upgrader.rb

Replace all usages of git command with configurable binary path

2015-11-03 17:11:09 -05:00

uploads_transfer.rb

Fix: Images cannot show when projects' path was changed

2015-10-14 18:50:35 +03:00

url_builder.rb

Merge branch 'wiki-fix-reloaded' into 'master'

2016-05-19 13:07:06 -05:00

user_access.rb

Move method to User

2016-03-10 12:37:14 +01:00

utils.rb

add common method to force utf8 and force oauth properties to be utf8

2015-05-03 00:43:46 +03:00

version_info.rb

Fix abort gitlab:app:check

2013-06-06 10:10:51 +09:00

visibility_level.rb

Fix specs

2016-03-20 23:26:58 +01:00

workhorse.rb

Fix API

2016-02-11 18:10:14 +01:00