Merge branch '5-4-security-update' of /home/git/repositories/gitlab/gitlabhq into 5-4-stable

Gemfile

@@ -23,7 +23,7 @@ gem 'omniauth-github'
 
 # Extracting information from a git repository
 # Provide access to Gitlab::Git library
-gem 'gitlab_git', '~> 1.3.0'
+gem 'gitlab_git', '~> 1.3.1'
 
 # Ruby/Rack Git Smart-HTTP Server Handler
 gem 'gitlab-grack', '~> 1.0.1', require: 'grack'

Gemfile.lock

@@ -167,7 +167,7 @@ GEM
       stringex (~> 1.5.1)
     gitlab-grack (1.0.1)
       rack (~> 1.4.1)
-    gitlab-grit (2.5.1)
+    gitlab-grit (2.5.2)
       charlock_holmes (~> 0.6.9)
       diff-lcs (~> 1.1)
       mime-types (~> 1.15)
@@ -175,10 +175,10 @@ GEM
     gitlab-pygments.rb (0.3.2)
       posix-spawn (~> 0.3.6)
       yajl-ruby (~> 1.1.0)
-    gitlab_git (1.3.0)
+    gitlab_git (1.3.1)
       activesupport (~> 3.2.13)
       github-linguist (~> 2.3.4)
-      gitlab-grit (~> 2.5.1)
+      gitlab-grit (~> 2.5.2)
     gitlab_meta (5.0)
     gitlab_omniauth-ldap (1.0.3)
       net-ldap (~> 0.3.1)
@@ -566,7 +566,7 @@ DEPENDENCIES
   gitlab-gollum-lib (~> 1.0.0)
   gitlab-grack (~> 1.0.1)
   gitlab-pygments.rb (~> 0.3.2)
-  gitlab_git (~> 1.3.0)
+  gitlab_git (~> 1.3.1)
   gitlab_meta (= 5.0)
   gitlab_omniauth-ldap (= 1.0.3)
   gon

VERSION

-5.4.0
\ No newline at end of file
+5.4.1

app/contexts/search_context.rb

@@ -7,6 +7,7 @@ class SearchContext
 
   def execute
     query = params[:search]
+    query = Shellwords.shellescape(query) if query.present?
 
     return result unless query.present?
 

config/initializers/connection_fix.rb

-# from http://gist.github.com/238999
-#
-# If your workers are inactive for a long period of time, they'll lose
-# their MySQL connection.
-#
-# This hack ensures we re-connect whenever a connection is
-# lost. Because, really. why not?
-#
-# Stick this in RAILS_ROOT/config/initializers/connection_fix.rb (or somewhere similar)
-#
-# From:
-#   http://coderrr.wordpress.com/2009/01/08/activerecord-threading-issues-and-resolutions/
-
-if defined?(ActiveRecord::ConnectionAdapters::Mysql2Adapter)
-
-  module ActiveRecord::ConnectionAdapters
-
-    class Mysql2Adapter
-      alias_method :execute_without_retry, :execute
-
-      def execute(*args)
-        execute_without_retry(*args)
-      rescue ActiveRecord::StatementInvalid => e
-        if e.message =~ /server has gone away/i
-          warn "Server timed out, retrying"
-          reconnect!
-          retry
-        else
-          raise e
-        end
-      end
-    end
-
-  end
-
-end

doc/install/installation.md

@@ -119,7 +119,7 @@ GitLab Shell is a ssh access and repository management software developed specia
     cd gitlab-shell
 
     # switch to right version
-    sudo -u git -H git checkout v1.5.0
+    sudo -u git -H git checkout v1.7.4
 
     sudo -u git -H cp config.yml.example config.yml
 

lib/tasks/gitlab/check.rake

@@ -657,7 +657,7 @@ namespace :gitlab do
   end
 
   def check_gitlab_shell
-    required_version = Gitlab::VersionInfo.new(1, 4, 0)
+    required_version = Gitlab::VersionInfo.new(1, 7, 4)
     current_version = Gitlab::VersionInfo.parse(gitlab_shell_version)
 
     print "GitLab Shell version >= #{required_version} ? ... "

lib/tasks/gitlab/test.rake

 namespace :gitlab do
   desc "GITLAB | Run both spinach and rspec"
-  task test: ['spinach', 'spec']
+  task test: ['db:setup', 'spinach', 'spec']
 end