- 28 Jul, 2021 16 commits
-
-
Dylan Griffith authored
This method joins between `ci_*` and non `ci_*` tables and as such we need to replace this logic with something that does not do this join before we move `ci_*` tables to a different database. This method `Vulnerabilities::Feedback.only_valid_feedback` was introduced originally in https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/117 to solve a security vulnerability https://gitlab.com/gitlab-org/gitlab/-/issues/24932. The basic issue was that we had a controller that allowed you to create a `Vulnerability::Feedback` and set the `pipeline_id` of that. The problem is that for a window of time a user could have set the `pipeline_id` to be from a different project. We also had another controller that would present the `path` for a pipeline and as such you could learn the path of private projects by guessing the `pipeline_id` from other projects. The original fix used a `join ci_pipelines` to filter out any `Vulnerabilities::Feedback` that happened to be associated to another project. We can't do this join anymore. It seemed simpler to change the security fix to focus on not rendering the `pipeline` if the `project_id` was belonging to a different project. So instead we just don't return `pipeline` if the `project_id` is not what it should be (ie. they hacked the `pipeline_id` to be a different project). This may present some issue in the frontend but this data should only appear if the user in the project deliberately created this hack data so we shouldn't be concerned about the UX impact here. It's also possible this fix improves performance for this endpoint as it doesn't need to do a redundant join. Since this fixes the problem in a slightly different way it also required us to change the test slightly to assert the `pipeline` is filtered out now rather than the whole `Feedback` object.
-
Marcel Amirault authored
Add constraints regarding the registry password See merge request gitlab-org/gitlab!66975
-
Tim Poffenbarger authored
-
James Fargher authored
Revert "Merge branch 'enable_gitaly_backup' into 'master'" See merge request gitlab-org/gitlab!66993
-
Albert Salim authored
This reverts merge request !66019
-
Thong Kuah authored
Include database name in performance bar See merge request gitlab-org/gitlab!63819
-
Russell Dickenson authored
Refine content for recently renamed feature See merge request gitlab-org/gitlab!66891
-
Evan Read authored
-
Thong Kuah authored
Bump kas to v14.1.1 See merge request gitlab-org/gitlab!66806
-
Mark Chao authored
Setup GitLab MailGun endpoint for syncing bounced invite emails - redo See merge request gitlab-org/gitlab!66397
-
Ash McKenzie authored
Fix disable_prepared_statements clobbering pool size See merge request gitlab-org/gitlab!66988
-
Ezekiel Kigbo authored
Resolve "Visual review is hard to find / confused with review app" See merge request gitlab-org/gitlab!66453
-
Marcel van Remmerden authored
-
Thong Kuah authored
Use a fresh config when using with establish_connection
-
Shinya Maeda authored
Add worker_resource_boundary to Release workers See merge request gitlab-org/gitlab!66870
-
Russell Dickenson authored
Tidy the introduced-in line for cherry-picking See merge request gitlab-org/gitlab!66977
-
- 27 Jul, 2021 24 commits
-
-
Marcel Amirault authored
Add clarification to steps for Kubernetes Agent install See merge request gitlab-org/gitlab!66966
-
DarwinJS authored
-
Dylan Griffith authored
Remove unused association code from DAST models See merge request gitlab-org/gitlab!66900
-
Mark Lapierre authored
Update expectation to match new UI text See merge request gitlab-org/gitlab!66970
-
Tiffany Rea authored
-
Mayra Cabrera authored
Add web_edit instrumentation class See merge request gitlab-org/gitlab!66789
-
Amy Qualls authored
Small fixes to the introduced-in line for cherry-picking into a project. Punctuation, linking.
-
Patrick Bair authored
Finalize conversion to bigint for ci_build_trace_chunks See merge request gitlab-org/gitlab!66123
-
Michael Kozono authored
Update N+1 spec for artifacts See merge request gitlab-org/gitlab!65354
-
Russell Dickenson authored
Update broken links to ZAP documentation See merge request gitlab-org/gitlab!66914
-
Mayra Cabrera authored
Mark StoreScansWorker as cpu bound See merge request gitlab-org/gitlab!66879
-
Suzanne Selhorn authored
Added new security checklist items See merge request gitlab-org/gitlab!66965
-
Nick Gaskill authored
Explain how to export group wikis See merge request gitlab-org/gitlab!66961
-
Amy Qualls authored
-
Luis Mejia authored
-
Suzanne Selhorn authored
Update Style Guide metadata with direct link See merge request gitlab-org/gitlab!66934
-
Mayra Cabrera authored
Add param to query Users API by group SAML provider id See merge request gitlab-org/gitlab!66167
-
Lyn Landon authored
-
Doug Stull authored
- update for consuming failure endpoints from Mailgun Changelog: added
-
Alex Kalderimis authored
Clean up evalute_protected_tag_for_release_permissions feature flag See merge request gitlab-org/gitlab!66713
-
Doug Stull authored
Advanced Search should index trials regardless of seats See merge request gitlab-org/gitlab!66665
-
Alex Kalderimis authored
Make experiments API a filter of features API See merge request gitlab-org/gitlab!66488
-
Doug Stull authored
- adds gates info with percentage Changelog: changed EE: true
-
Rémy Coutable authored
Transition from Engineering Productivity to tooling label in Danger See merge request gitlab-org/gitlab!66620
-