-[Public access](public_access/public_access.md) Learn how you can allow public and internal access to projects.
-[Analytics](analytics/README.md)
-[SSH](ssh/README.md) Setup your ssh keys and deploy keys for secure access to your projects.
-[Webhooks](web_hooks/web_hooks.md) Let GitLab notify you when new code has been pushed to your project.
-[Webhooks](web_hooks/web_hooks.md) Let GitLab notify you when new code has been pushed to your project.
-[Workflow](workflow/README.md) Using GitLab functionality and importing projects from GitHub and SVN.
-[GitLab Pages](pages/README.md) Using GitLab Pages.
-[Custom templates for issues and merge requests](customization/issue_and_merge_request_template.md) Pre-fill the description of issues and merge requests to your liking.
...
...
@@ -59,7 +59,7 @@ be linked with your base image. Below is a list of examples you may use:
-[Audit Events](administration/audit_events.md) Check how user access changed in projects and groups.
-[Changing the appearance of the login page](customization/branded_login_page.md) Make the login page branded for your GitLab instance.
-[Custom git hooks](hooks/custom_hooks.md) Custom git hooks (on the filesystem) for when webhooks aren't enough.
-[Custom git hooks](hooks/custom_hooks.md) Custom git hooks (on the filesystem) for when webhooks aren't enough.
-[Email](tools/email.md) Email GitLab users from GitLab
-[Git Hooks](git_hooks/git_hooks.md) Advanced push rules for your project.
-[Help message](customization/help_message.md) Set information about administrators of your GitLab instance.
...
...
@@ -72,7 +72,7 @@ be linked with your base image. Below is a list of examples you may use:
-[Log system](logs/logs.md) Log system.
-[Environment Variables](administration/environment_variables.md) to configure GitLab.
-[Operations](operations/README.md) Keeping GitLab up and running
-[Raketasks](raketasks/README.md) Backups, maintenance, automatic webhook setup and the importing of projects.
-[Raketasks](raketasks/README.md) Backups, maintenance, automatic webhook setup and the importing of projects.
-[Security](security/README.md) Learn what you can do to further secure your GitLab instance.
-[System hooks](system_hooks/system_hooks.md) Notifications when users, projects and keys are changed.
-[Update](update/README.md) Update guides to upgrade your installation.
**Note: Custom git hooks must be configured on the filesystem of the GitLab
server. Only GitLab server administrators will be able to complete these tasks.
Please explore [webhooks](doc/web_hooks/web_hooks.md) as an option if you do not have filesystem access. For a user configurable Git Hooks interface, please see [GitLab Enterprise Edition Git Hooks](http://doc.gitlab.com/ee/git_hooks/git_hooks.html).**
Please explore [webhooks](doc/web_hooks/web_hooks.md) as an option if you do not have filesystem access. For a user configurable Git Hooks interface, please see [GitLab Enterprise Edition Git Hooks](http://doc.gitlab.com/ee/git_hooks/git_hooks.html).**
Git natively supports hooks that are executed on different actions.
Examples of server-side git hooks include pre-receive, post-receive, and update.
_GitLab uses the [Redcarpet Ruby library][redcarpet] for Markdown processing._
For GitLab we developed something we call "GitLab Flavored Markdown" (GFM). It extends the standard Markdown in a few significant ways to add some useful functionality.
You can use GFM in
...
...
@@ -88,8 +90,8 @@ GFM will autolink almost any URL you copy and paste into your text.
## Code and Syntax Highlighting
_GitLab uses the [rouge ruby library][rouge] for syntax highlighting. For a
list of supported languages visit the rouge website._
_GitLab uses the [Rouge Ruby library][rouge] for syntax highlighting. For a
list of supported languages visit the Rouge website._
Blocks of code are either fenced by lines with three back-ticks <code>```</code>, or are indented with four spaces. Only the fenced code blocks support syntax highlighting.
...
...
@@ -591,3 +593,4 @@ By including colons in the header row, you can align the text within that column
- [Dillinger.io](http://dillinger.io) is a handy tool for testing standard markdown.
If you have non-GitLab web services running on your GitLab server or within its local network, these may be vulnerable to exploitation via Web Hooks.
If you have non-GitLab web services running on your GitLab server or within its local network, these may be vulnerable to exploitation via Webhooks.
With [Web Hooks](../web_hooks/web_hooks.md), you and your project masters and owners can set up URLs to be triggered when specific things happen to projects. Normally, these requests are sent to external web services specifically set up for this purpose, that process the request and its attached data in some appropriate way.
With [Webhooks](../web_hooks/web_hooks.md), you and your project masters and owners can set up URLs to be triggered when specific things happen to projects. Normally, these requests are sent to external web services specifically set up for this purpose, that process the request and its attached data in some appropriate way.
Things get hairy, however, when a Web Hook is set up with a URL that doesn't point to an external, but to an internal service, that may do something completely unintended when the web hook is triggered and the POST request is sent.
Things get hairy, however, when a Webhook is set up with a URL that doesn't point to an external, but to an internal service, that may do something completely unintended when the webhook is triggered and the POST request is sent.
Because Web Hook requests are made by the GitLab server itself, these have complete access to everything running on the server (http://localhost:123) or within the server's local network (http://192.168.1.12:345), even if these services are otherwise protected and inaccessible from the outside world.
Because Webhook requests are made by the GitLab server itself, these have complete access to everything running on the server (http://localhost:123) or within the server's local network (http://192.168.1.12:345), even if these services are otherwise protected and inaccessible from the outside world.
If a web service does not require authentication, Web Hooks can be used to trigger destructive commands by getting the GitLab server to make POST requests to endpoints like "http://localhost:123/some-resource/delete".
If a web service does not require authentication, Webhooks can be used to trigger destructive commands by getting the GitLab server to make POST requests to endpoints like "http://localhost:123/some-resource/delete".
To prevent this type of exploitation from happening, make sure that you are aware of every web service GitLab could potentially have access to, and that all of these are set up to require authentication for every potentially destructive command. Enabling authentication but leaving a default password is not enough.
- _the `project.ssh_url` key is deprecated in favor of the `project.git_ssh_url` key_
- _the `project.http_url` key is deprecated in favor of the `project.git_http_url` key_
Project webhooks allow you to trigger an URL if new code is pushed or a new issue is created.
Project webhooks allow you to trigger an URL if new code is pushed or a new issue is created.
You can configure web hooks to listen for specific events like pushes, issues or merge requests. GitLab will send a POST request with data to the web hook URL.
You can configure webhooks to listen for specific events like pushes, issues or merge requests. GitLab will send a POST request with data to the webhook URL.
Webhooks can be used to update an external issue tracker, trigger CI builds, update a backup mirror, or even deploy to your production server.
Webhooks can be used to update an external issue tracker, trigger CI builds, update a backup mirror, or even deploy to your production server.
In GitLab Enterprise Edition you can configure web hooks globally for the whole
group. You can add the group level web hooks on the group settings page
...
...
@@ -23,7 +23,7 @@ By default, the SSL certificate of the webhook endpoint is verified based on
an internal list of Certificate Authorities,
which means the certificate cannot be self-signed.
You can turn this off in the webhook settings in your GitLab projects.
You can turn this off in the webhook settings in your GitLab projects.