Commit Graph

9 Commits

Author SHA1 Message Date
GitLab Bot 0ae8428c8e Add latest changes from gitlab-org/gitlab@master 2021-05-11 21:10:21 +00:00
Joern Schneeweisz e3c910927c Use the '\A' and '\z' regex anchors in `InternalRedirect` to mitigate an Open Redirect issue.
Fixes https://dev.gitlab.org/gitlab/gitlabhq/issues/2934 and https://gitlab.com/gitlab-org/gitlab/issues/33569
2019-10-08 08:53:36 +02:00
GitLab Bot b7dfe2ae40 Add latest changes from gitlab-org/gitlab@master 2019-09-13 13:26:31 +00:00
Markus Koller db132bae1d
Support redirect paths starting with a dash
We use a leading dash for certain things like the WebIDE, which
had the side effect of losing the `params[:continue][:to]` param when
opening the WebIDE on a project where the user doesn't have push access
and therefore needs to fork the project first.
2019-06-25 13:19:30 +02:00
Stan Hu 711e9f0796 Merge branch 'frozen-string-app-controller' into 'master'
Enable frozen string in app/controllers/**/*.rb

See merge request gitlab-org/gitlab-ce!21736
2018-09-20 22:53:27 +00:00
Martin Wortschack df9cb93091 Add empty controller actions and utilize referer_path helper 2018-09-19 12:57:14 +02:00
gfyoung 73322a0e55 Enable frozen string in app/controllers/**/*.rb
Enables frozen string for the following:

* app/controllers/*.rb
* app/controllers/admin/**/*.rb
* app/controllers/boards/**/*.rb
* app/controllers/ci/**/*.rb
* app/controllers/concerns/**/*.rb

Partially addresses #47424.
2018-09-18 21:22:45 -07:00
James Edwards-Jones 202bd2da16 Backport InternalRedirect#sanitize_redirect 2018-06-14 09:02:32 +10:00
Bob Van Landuyt 7684217d68 Enforces terms in the web application
This enforces the terms in the web application. These cases are
specced:

- Logging in: When terms are enforced, and a user logs in that has not
  accepted the terms, they are presented with the screen. They get
  directed to their customized root path afterwards.
- Signing up: After signing up, the first screen the user is presented
  with the screen to accept the terms. After they accept they are
  directed to the dashboard.
- While a session is active:
  - For a GET: The user will be directed to the terms page first,
    after they accept the terms, they will be directed to the page
    they were going to
  - For any other request: They are directed to the terms, after they
    accept the terms, they are directed back to the page they came
    from to retry the request. Any information entered would be
    persisted in localstorage and available on the page.
2018-05-04 13:54:43 +02:00