1. 12 Jun, 2019 1 commit
    • Luke Duncalfe's avatar
      Authorize access before serving project template · 136db4dd
      Luke Duncalfe authored
      Previously, if a user was a guest member of a private project, they
      could access the merge request template as we were not checking
      permission-levels of the user.
      
      When a issue template is asked for, the user must have :read_issue for
      the project; or :read_merge_request when a merge request template is
      asked for.
      
      We also now rescue_from FileNotFoundError and handle as 404. This is
      because RepoTemplateFinder can raise a FileNotFoundError exception,
      which Rails previously handled as a 500.
      
      Handling these in a way that is consistent with
      ActiveRecord::RecordNotFound exceptions, within controllers that
      inherit from Projects::ApplicationController at least, and returning a
      404.
      
      https://gitlab.com/gitlab-org/gitlab-ce/issues/54943
      136db4dd
  2. 10 Jun, 2019 16 commits
  3. 06 Jun, 2019 1 commit
    • John Cai's avatar
      Update Gitaly to 1.42.4 · f71e4a4a
      John Cai authored
      This patch of Gitaly includes a fix of the stderr logger writer to fix a
      panic that occured during an edge case.
      f71e4a4a
  4. 04 Jun, 2019 5 commits
  5. 03 Jun, 2019 10 commits
  6. 30 May, 2019 4 commits
  7. 29 May, 2019 3 commits