Robert SpeicherandTomasz Maczukin 2da3f39258 Merge branch '17298-wiki-xss' into 'master' ...

Forbid scripting for wiki files

Wiki files (not pages - files in the repo) are just sent to the browser
with whatever content-type the mime_types gem assigns to them based on
their extension. As this is from the same domain as the GitLab
application, this is an XSS vulnerability.

Set a CSP forbidding all sources for scripting, CSS, XHR, etc. on these
files.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/17298.

See merge request !1969

2016-06-14 22:26:03 +02:00

..

application_controller.rb

Clarify that the diff view setting always comes from the cookie

2016-04-19 17:47:58 -04:00

artifacts_controller.rb

Merge branch 'fix/unauthorized-access-to-build-data' into 'master'

2016-06-14 22:25:10 +02:00

avatars_controller.rb

Tweaks, refactoring, and specs

2016-03-20 21:04:07 +01:00

badges_controller.rb

Use default branch when displaying list of badges

2016-04-06 19:56:35 +02:00

blame_controller.rb

Move blame group logic to dedicated class

2016-01-28 14:49:21 +01:00

blob_controller.rb

Add a Blob model that wraps Gitlab::Git::Blob

2016-02-18 22:45:30 -05:00

branches_controller.rb

Return status code 303 after a branch DELETE operation to avoid project deletion

2016-04-06 21:11:10 -07:00

builds_controller.rb

Merge branch 'fix/unauthorized-access-to-build-data' into 'master'

2016-06-14 22:25:10 +02:00

commit_controller.rb

Satisfy Rubocop

2016-05-13 17:31:58 -05:00

commits_controller.rb

API support for the 'since' and 'until' operators on commit requests

2016-04-29 09:26:52 +02:00

compare_controller.rb

Use @diff_notes_disabled instead of @comments_allowed

2016-05-13 17:31:58 -05:00

container_registry_controller.rb

Verify if registry is enabled in registry

2016-05-18 12:28:48 -05:00

deploy_keys_controller.rb

Project deploy keys updated UI

2016-04-25 16:26:41 +01:00

find_file_controller.rb

Merge branch 'master' of github.com:gitlabhq/gitlabhq

2016-01-07 12:56:18 +01:00

forks_controller.rb

Use the configured Kaminari "per page" default

2016-03-19 17:37:54 -04:00

graphs_controller.rb

API support for the 'since' and 'until' operators on commit requests

2016-04-29 09:26:52 +02:00

group_links_controller.rb

Use guard clause to check ability to share project

2016-04-19 12:15:56 +02:00

hooks_controller.rb

Always mention HTTP status

2016-05-03 13:42:56 +02:00

imports_controller.rb

removed transaction stuff

2016-05-13 13:12:21 +02:00

issues_controller.rb

Handle issue move access instead of raising error

2016-04-30 21:28:40 +02:00

labels_controller.rb

Use the configured Kaminari "per page" default

2016-03-19 17:37:54 -04:00

merge_requests_controller.rb

Merge branch 'merge-button-color-fix' into 'master'

2016-06-02 13:21:58 +02:00

milestones_controller.rb

Merge branch 'meinac/gitlab-ce-change_deprecated_render_usage'

2016-05-18 12:48:23 -05:00

network_controller.rb

Fix network graph when branch name has single quotes

2015-07-29 23:29:47 -07:00

notes_controller.rb

Merge branch 'meinac/gitlab-ce-change_deprecated_render_usage'

2016-05-18 12:48:23 -05:00

notification_settings_controller.rb

Simplify Projects::NotificationSettingsController

2016-04-12 12:10:58 -03:00

pipelines_controller.rb

Create pipeline objects with parameters

2016-05-18 17:01:42 -05:00

project_members_controller.rb

Merge branch 'meinac/gitlab-ce-change_deprecated_render_usage'

2016-05-18 12:48:23 -05:00

protected_branches_controller.rb

Change deprecated usage of rendering without response body

2016-03-16 03:16:25 +02:00

raw_controller.rb

Refactor caching code

2016-03-07 14:27:53 +01:00

refs_controller.rb

Make it possible to switch ref in badges view

2016-04-06 19:56:34 +02:00

releases_controller.rb

Refactor release code a bit

2015-11-09 15:30:50 +01:00

repositories_controller.rb

Move RepositoryArchiveCacheWorker to sidekiq-cron

2016-04-12 11:12:05 -04:00

runner_projects_controller.rb

Make the CI permission model simpler

2016-02-02 09:18:08 +01:00

runners_controller.rb

Improve displaying validation messages for runner

2016-05-19 22:01:53 +02:00

services_controller.rb

add slack notifications for wiki pages

2016-04-20 08:25:40 +08:00

snippets_controller.rb

Ensure project snippets have their own access level

2016-03-25 18:51:17 +01:00

tags_controller.rb

Use the configured Kaminari "per page" default

2016-03-19 17:37:54 -04:00

tree_controller.rb

Fix specs and behavior for LFS files

2015-12-18 16:14:12 +01:00

triggers_controller.rb

Make the CI permission model simpler

2016-02-02 09:18:08 +01:00

uploads_controller.rb

Address feedback

2016-03-22 00:09:20 +01:00

variables_controller.rb

Project variables UI

2016-05-16 10:21:51 +01:00

wikis_controller.rb

Merge branch '17298-wiki-xss' into 'master'

2016-06-14 22:26:03 +02:00