Merge pull request #1632 from NARKOZ/patch-0

performance and security fixes

app/assets/stylesheets/main.scss

@@ -8,7 +8,7 @@ $style_color: #474d57;
 $hover: #D9EDF7;
 
 /** GitLab Fonts **/
-@font-face { font-family: Korolev; src: url('korolev-medium-compressed.otf'); }
+@font-face { font-family: Korolev; src: font-url('korolev-medium-compressed.otf'); }
 
 /** MIXINS **/
 @mixin shade {

config/application.rb

@@ -50,8 +50,5 @@ module Gitlab
 
     # Version of your assets, change this if you want to expire all your assets
     config.assets.version = '1.0'
-
-    # Add fonts
-    config.assets.paths << "#{Rails.root}/app/assets/fonts"
   end
 end

config/routes.rb

@@ -184,7 +184,8 @@ Gitlab::Application.routes.draw do
     resources :blame,   only: [:show], constraints: {id: /.+/}
     resources :blob,    only: [:show], constraints: {id: /.+/}
     resources :tree,    only: [:show], constraints: {id: /.+/}
-    match "/compare/:from...:to" => "compare#show", as: "compare", constraints: {from: /.+/, to: /.+/}
+    match "/compare/:from...:to" => "compare#show", as: "compare",
+                    :via => [:get, :post], constraints: {from: /.+/, to: /.+/}
 
     resources :team, controller: 'team_members', only: [:index]
     resources :team_members

lib/emoji.rb

+module Emoji
+  path  = "#{Rails.root}/vendor/assets/images/emoji"
+  NAMES = Dir["#{path}/*.png"].sort.map {|f| File.basename(f, '.png')}
+end

lib/gitlab/markdown.rb

@@ -128,7 +128,7 @@ module Gitlab
     #
     # Returns boolean
     def valid_emoji?(emoji)
-      File.exists?(Rails.root.join('app', 'assets', 'images', 'emoji', "#{emoji}.png"))
+      Emoji::NAMES.include? emoji
     end
 
     # Private: Dispatches to a dedicated processing method based on reference