- 07 Apr, 2015 1 commit
-
-
Patricio Cano authored
Fix LDAP group links page by using new group members route. - Reported by Apple: https://gitlab.zendesk.com/agent/tickets/2273 - Reported on gitlab.com: https://gitlab.com/gitlab-org/gitlab-ce/issues/1382 cc @patricio See merge request !364
-
- 06 Apr, 2015 1 commit
-
-
Douwe Maan authored
-
- 02 Apr, 2015 1 commit
-
-
Marin Jankovski authored
-
- 01 Apr, 2015 1 commit
-
-
Job van der Voort authored
Add packages for rugged patch releases See merge request !290
-
- 27 Mar, 2015 1 commit
-
-
Marin Jankovski authored
-
- 26 Mar, 2015 9 commits
-
-
Dmitriy Zaporozhets authored
Default git hook Implements #235  See merge request !361
-
Valery Sizov authored
-
Dmitriy Zaporozhets authored
Fix LDAP migrator to new_syntax See merge request !362
-
Valery Sizov authored
-
Valery Sizov authored
-
Valery Sizov authored
-
Valery Sizov authored
-
Valery Sizov authored
-
Jacob Vosmaer authored
Corrected LDAP documentation to include `admin_group` in the new syntax. Fixes #255 /cc @job See merge request !338
-
- 25 Mar, 2015 14 commits
-
-
Marin Jankovski authored
-
Dmitriy Zaporozhets authored
-
Dmitriy Zaporozhets authored
Conflicts: app/assets/javascripts/dispatcher.js.coffee features/admin/settings.feature features/steps/admin/settings.rb features/steps/user.rb features/user.feature lib/gitlab/git_access.rb
-
Dmitriy Zaporozhets authored
-
Dmitriy Zaporozhets authored
More rubocop styles See merge request !449
-
Hannes Rosenögger authored
Documentation - Markdown - added missing line-break info as promised, I updated the Markdown documentation with the line-breaks info See merge request !186
-
Robert Schilling authored
-
Robert Schilling authored
Fix GitLab shell setup spacing
-
Dmitriy Zaporozhets authored
Respond with full GitAccess error if user has project read access. Should help with debugging #1236. cc @marin See merge request !437
-
Dmitriy Zaporozhets authored
Improve sticky headers in diffs * disable sticky headers in discussion * enable sticky header on mr page with you click changes tab See merge request !450
-
Dmitriy Zaporozhets authored
* disable sticky headers in discussion * enable sticky header on mr page with you click changes tab
-
Dmitriy Zaporozhets authored
-
Dmitriy Zaporozhets authored
-
Dmitriy Zaporozhets authored
Milestones and labels can be used even when issues are disabled. When Issues are disabled for a project Milestones and Labels can still be used for Merge Requests. See merge request !1739
-
- 24 Mar, 2015 12 commits
-
-
Dmitriy Zaporozhets authored
Change merge request button color based on CI status Green button looks confusing when CI fails Screenshots:   See merge request !448
-
Dmitriy Zaporozhets authored
Link note avatar to user. See merge request !446
-
Dmitriy Zaporozhets authored
Clean up subscriptions when user is deleted. cc @vsizov See merge request !439
-
Dmitriy Zaporozhets authored
Update rugments to 1.0.0.beta6 to fix C# highlighting. Fixes #1259. See merge request !435
-
Dmitriy Zaporozhets authored
-
Dmitriy Zaporozhets authored
-
Dmitriy Zaporozhets authored
-
Dmitriy Zaporozhets authored
-
Dmitriy Zaporozhets authored
Unescape branch param to delete
-
Dmitriy Zaporozhets authored
Complete transition to using color_field for selecting colors
-
Marin Jankovski authored
-
Dmitriy Zaporozhets authored
Reduce Rack Attack false positives causing 403 errors during HTTP authentication ### What does this MR do? This MR reduces false positives causing `403 Forbidden` messages after HTTP authentication. A Git client may attempt to access a repository without a password. If it receives a 401 error, the client often will try again, this time supplying a password. The problem is that `grack_auth.rb` considers a blank password an authentication failure and increases a Redis counter each time this happens. With enough requests, an IP can be banned temporarily even though previous attempts may have been successful. This leads users to see `403 Forbidden` errors until the ban times out (default: 1 hour). To reduce the chance of a false positive, this MR resets the counter upon a successful authentication from an IP. In addition, this MR logs when a user has been banned and introduces the ability to disable Rack Attack via a config variable. ### Are there points in the code the reviewer needs to double check? rack-attack v4.2.0 doesn't support the ability to clear counters out of the box, so `rack_attack_helpers.rb` includes a number of monkey patches to make it work. It looks like this functionality may be added in v4.3.0. I've also sent pull requests to rack-attack to add the functionality necessary to delete a key. Each time an authentication is successful, the Redis counter for that IP is cleared. I deemed it better to clear the counter than to allow for blank passwords, since the latter seems like a security risk. ### Why was this MR needed? It was quite difficult to figure out why users were seeing `403 Forbidden`, which is why the log message was added. Users were getting a lot of false positives when accessing repositories with HTTPS. Including the username in the HTTPS URL (e.g. `https://username@mydomain.com/account/repo.git`) caused authentication failures because while the git client provided the username, it left the password blank, leading to an authentication failure. ### What are the relevant issue numbers / [Feature requests](http://feedback.gitlab.com/)? See Issue #1171 https://github.com/kickstarter/rack-attack/issues/113 See merge request !392
-