An error occurred fetching the project authors.
  1. 15 Dec, 2016 2 commits
    • tauriedavis's avatar
    • Douwe Maan's avatar
      Merge branch 'jej-note-search-uses-finder' into 'security' · 12db4cc0
      Douwe Maan authored
      Fix missing Note access checks in by moving Note#search to updated NoteFinder
      
      Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867
      
      ## Which fixes are in this MR?
      
      :warning: - Potentially untested  
      :bomb: - No test coverage  
      :traffic_light: - Test coverage of some sort exists (a test failed when error raised)  
      :vertical_traffic_light: - Test coverage of return value (a test failed when nil used)  
      :white_check_mark: - Permissions check tested
      
      ### Note lookup without access check
      
      - [x] :white_check_mark: app/finders/notes_finder.rb:13 :download_code check
      - [x] :white_check_mark: app/finders/notes_finder.rb:19 `SnippetsFinder`
      - [x] :white_check_mark: app/models/note.rb:121 [`Issue#visible_to_user`]
      - [x] :white_check_mark: lib/gitlab/project_search_results.rb:113
        - This is the only use of `app/models/note.rb:121` above, but importantly has no access checks at all. This means it leaks MR comments and snippets when those features are `team-only` in addition to the issue comments which would be fixed by `app/models/note.rb:121`.
        - It is only called from SearchController where `can?(current_user, :download_code, @project)` is checked, so commit comments are not leaked.
      
      ### Previous discussions
      - [x] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b915c5267a63628b0bafd23d37792ae73ceae272_13_13 `: download_code` check on commit
      - [x] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b915c5267a63628b0bafd23d37792ae73ceae272_19_19 `SnippetsFinder` should be used
        - `SnippetsFinder` should check if the snippets feature is enabled -> https://gitlab.com/gitlab-org/gitlab-ce/issues/25223
      
      ###  Acceptance criteria met?
      - [x] Tests added for new code
      - [x] TODO comments removed
      - [x] Squashed and removed skipped tests
      - [x] Changelog entry
      - [ ] State Gitlab versions affected and issue severity in description
      - [ ] Create technical debt issue for NotesFinder.
        - Either split into `NotesFinder::ForTarget` and `NotesFinder::Search` or consider object per notable type such as `NotesFinder::OnIssue`. For the first option could create `NotesFinder::Base` which is either inherited from or which can be included in the other two.
        - Avoid case statement anti-pattern in this finder with use of `NotesFinder::OnCommit` etc. Consider something on the finder for this? `Model.finder(user, project)`
        - Move `inc_author` to the controller, and implement `related_notes` to replace `non_diff_notes`/`mr_and_commit_notes`
      
      See merge request !2035
      12db4cc0
  2. 09 Dec, 2016 1 commit
  3. 07 Dec, 2016 1 commit
    • Rydkin Maxim's avatar
      add link_to_if helper on target_branch link on Merge Request show page for... · 0a8289ca
      Rydkin Maxim authored
      add link_to_if helper on target_branch link on Merge Request show page for case of deleted target branch
      
      add spec on #24507 bug description
      
      add changelog entry
      
      fix changelog
      
      remove unnecessary js:true from specs
      
      change spec title
      
      add test for link to target branch before deletions
      
      renamed spec about state of target branch link before and after deletion
      
      some fixes into spec
      0a8289ca
  4. 28 Nov, 2016 1 commit
  5. 15 Nov, 2016 1 commit
  6. 14 Nov, 2016 1 commit
  7. 10 Nov, 2016 1 commit
  8. 20 Oct, 2016 3 commits
  9. 19 Oct, 2016 1 commit
  10. 18 Oct, 2016 1 commit
  11. 10 Oct, 2016 1 commit
  12. 09 Oct, 2016 1 commit
  13. 06 Oct, 2016 1 commit
  14. 05 Oct, 2016 1 commit
  15. 20 Sep, 2016 1 commit
  16. 13 Sep, 2016 1 commit
  17. 06 Sep, 2016 1 commit
  18. 19 Aug, 2016 1 commit
    • Gokmen Goksel's avatar
      Support integration with Koding (online IDE) · a927a9bf
      Gokmen Goksel authored
      Koding: #index: landing page for Koding integration
      
      If enabled it will provide a link to open remote Koding instance url
      for now we are also providing the sneak preview video for how
      integration works in detail.
      
      Repository: check whether .koding.yml file exists on repository
      
      Projects: landing page: show Run in IDE (Koding) button if repo has stack file
      
      Projects: MR: show Run in IDE Koding button if repo has stack file on active branch
      
      ProjectHelpers: add_koding_stack: stack generator for provided project
      
      With this helper we will auto-generate the required stack template
      for a given project. For the feature we can request this base template
      from the running Koding instance on integration.
      
      Currently this will provide users to create a t2.nano instance on aws
      and it'll automatically configures the instance for basic requirements.
      
      Projects: empty state and landing page provide shortcuts to create stack
      
      projects_helper: use branch on checkout and provide an entry point
      
      This ${var.koding_queryString_branch} will be replaced with the branch
      provided in query string which will allow us to use same stack template
      for different branches of the same repository.
      
      ref: https://github.com/koding/koding/pull/8597/commits/b8c0e43c4c24bf132670aa8a3cfb0d634acfd09b
      
      projects_helper: provide sha info in query string to use existing vms
      
      With this change we'll be able to query existing vms on Koding side
      based on the commit id that they've created.
      
      ref: https://github.com/koding/koding/pull/8597/commits/1d630fadf31963fa6ccd3bed92e526761a30a343
      
      Integration: Docs: Koding documentation added
      
      Disable /koding route if integration is disabled
      
      Use application settings to enable Koding
      
      Projects_helper: better indentation with strip_heredoc usage
      
      Projects_helper: return koding_url as is if there is no project provided
      
      current_settings: set koding_enabled: false by default
      
      Koding_Controller: to render not_found once integration is disabled
      
      Dashboard_specs: update spec for Koding enabled case
      
      Projects_Helper: make repo dynamic
      
      ref: https://github.com/koding/koding/pull/8597/commits/4d615242f45aaea4c4986be84ecc612b0bb1514c
      
      Updated documentation to have right format
      a927a9bf
  19. 16 Aug, 2016 1 commit
  20. 15 Aug, 2016 1 commit
  21. 12 Aug, 2016 2 commits
  22. 09 Aug, 2016 1 commit
  23. 05 Aug, 2016 1 commit
  24. 04 Aug, 2016 1 commit
  25. 01 Aug, 2016 2 commits
  26. 29 Jul, 2016 2 commits
  27. 27 Jul, 2016 2 commits
  28. 26 Jul, 2016 5 commits
  29. 25 Jul, 2016 1 commit