Commit graph

5 commits

Author SHA1 Message Date
GitLab Bot
640e72ca92 Add latest changes from gitlab-org/gitlab@master 2020-06-04 03:08:05 +00:00
GitLab Bot
1caa60060b Add latest changes from gitlab-org/gitlab@master 2019-12-19 00:08:01 +00:00
Markus Koller
8fd2c08472
Make checks for continue_params more robust
The check for continue_params&.key?(:to) in Projects::ImportsController
caused an exception in redirect_to if this key contained a nil value.

Since url_for won't add any params for an empty hash, we can just return
that in continue_params if params[:continue] isn't present, and simplify
the code in the controllers to check for the values we actually want to
use.
2019-06-25 13:19:29 +02:00
gfyoung
93a44e135b Add some frozen string to spec/**/*.rb
Adds frozen string to the following:

* spec/bin/**/*.rb
* spec/config/**/*.rb
* spec/controllers/**/*.rb

xref https://gitlab.com/gitlab-org/gitlab-ce/issues/59758
2019-04-15 10:17:05 +00:00
Bob Van Landuyt
39916fdfed Reuses InternalRedirect when possible
`InternalRedirect` prevents Open redirect issues by only allowing
redirection to paths on the same host.

It cleans up any unwanted strings from the path that could point to
another host (fe. //about.gitlab.com/hello). While preserving the
querystring and fragment of the uri.

It is already used by:

- `TermsController`
- `ContinueParams`
  - `ImportsController`
  - `ForksController`
- `SessionsController`: Only for verifying the host in CE. EE allows
   redirecting to a different instance using Geo.
2018-05-04 13:54:43 +02:00