1. 24 Jul, 2019 7 commits
  2. 17 Jul, 2019 1 commit
    • Bob Van Landuyt's avatar
      Filter params in MR build service · 8af7f42c
      Bob Van Landuyt authored
      Reusing the existing `IssuableBaseService#filter_params` which uses
      the policies to determine what params a user can set, and which values
      it can be set to.
      
      This also removed the need for the seperate call to
      `IssuableBaseService#ensure_milestone_available`.
      
      The `Issues::BuildService` does not suffer from this because it limits
      the params that are assignable to the `title`, `description` and
      `milestone_id`.
      8af7f42c
  3. 16 Jul, 2019 1 commit
  4. 15 Jul, 2019 1 commit
  5. 12 Jul, 2019 1 commit
  6. 10 Jul, 2019 1 commit
  7. 09 Jul, 2019 1 commit
  8. 05 Jul, 2019 1 commit
  9. 04 Jul, 2019 1 commit
    • Francisco Javier López's avatar
      Fix Server Side Request Forgery mitigation bypass · de9b7a69
      Francisco Javier López authored
      When we can't resolve the hostname or it is invalid, we shouldn't
      even perform the request. This fix also fixes the problem the
      SSRF rebinding attack.
      
      We can't stub feature flags outside example blocks. Nevertheless,
      there are some actions that calls the UrlBlocker, that are performed
      outside example blocks, ie: `set` instruction.
      
      That's why we have to use some signalign mechanism outside the scope
      of the specs.
      de9b7a69
  10. 01 Jul, 2019 2 commits
  11. 30 Jun, 2019 1 commit
  12. 27 Jun, 2019 2 commits
  13. 26 Jun, 2019 20 commits