5fbbd3dd6e
A nonce-based Content-Security-Policy thwarts XSS attacks by allowing
inline JavaScript to execute if the script nonce matches the header
value. Rails 5.2 supports nonce-based Content-Security-Policy headers,
so provide configuration to enable this and make it work.
To support this, we need to change all `:javascript` HAML filters to the
following form:
```
= javascript_tag nonce: true do
:plain
...
```
We use `%script` throughout our HAML to store JSON and other text, but
since this doesn't execute, browsers don't appear to block this content
from being used and require the nonce value to be present.
95 lines
5.1 KiB
Text
95 lines
5.1 KiB
Text
- @gfm_form = true
|
|
- @content_class = "limit-container-width" unless fluid_layout
|
|
- add_to_breadcrumbs "Merge Requests", project_merge_requests_path(@project)
|
|
- breadcrumb_title @merge_request.to_reference
|
|
- page_title "#{@merge_request.title} (#{@merge_request.to_reference})", "Merge Requests"
|
|
- page_description @merge_request.description
|
|
- page_card_attributes @merge_request.card_attributes
|
|
- suggest_changes_help_path = help_page_path('user/discussions/index.md', anchor: 'suggest-changes')
|
|
|
|
.merge-request{ data: { mr_action: j(params[:tab].presence || 'show'), url: merge_request_path(@merge_request, format: :json), project_path: project_path(@merge_request.project), lock_version: @merge_request.lock_version } }
|
|
= render "projects/merge_requests/mr_title"
|
|
|
|
.merge-request-details.issuable-details{ data: { id: @merge_request.project.id } }
|
|
= render "projects/merge_requests/mr_box"
|
|
|
|
- if @merge_request.source_branch_exists?
|
|
= render "projects/merge_requests/how_to_merge"
|
|
|
|
= javascript_tag nonce: true do
|
|
:plain
|
|
window.gl = window.gl || {};
|
|
window.gl.mrWidgetData = #{serialize_issuable(@merge_request, serializer: 'widget', issues_links: true)}
|
|
|
|
window.gl.mrWidgetData.squash_before_merge_help_path = '#{help_page_path("user/project/merge_requests/squash_and_merge")}';
|
|
window.gl.mrWidgetData.troubleshooting_docs_path = '#{help_page_path('user/project/merge_requests/index.md', anchor: 'troubleshooting')}';
|
|
|
|
#js-vue-mr-widget.mr-widget
|
|
|
|
.content-block.content-block-small.emoji-list-container.js-noteable-awards
|
|
= render 'award_emoji/awards_block', awardable: @merge_request, inline: true
|
|
|
|
.merge-request-tabs-holder{ class: ("js-tabs-affix" unless ENV['RAILS_ENV'] == 'test') }
|
|
.merge-request-tabs-container
|
|
%ul.merge-request-tabs.nav-tabs.nav.nav-links
|
|
%li.notes-tab{ data: { qa_selector: 'notes_tab'} }
|
|
= tab_link_for @merge_request, :show, force_link: @commit.present? do
|
|
= _("Discussion")
|
|
%span.badge.badge-pill= @merge_request.related_notes.user.count
|
|
- if @merge_request.source_project
|
|
%li.commits-tab
|
|
= tab_link_for @merge_request, :commits do
|
|
= _("Commits")
|
|
%span.badge.badge-pill= @commits_count
|
|
- if @pipelines.any?
|
|
%li.pipelines-tab
|
|
= tab_link_for @merge_request, :pipelines do
|
|
= _("Pipelines")
|
|
%span.badge.badge-pill.js-pipelines-mr-count= @pipelines.size
|
|
%li.diffs-tab.qa-diffs-tab
|
|
= tab_link_for @merge_request, :diffs do
|
|
= _("Changes")
|
|
%span.badge.badge-pill= @merge_request.diff_size
|
|
.d-flex.flex-wrap.align-items-center.justify-content-lg-end
|
|
#js-vue-discussion-filter{ data: { default_filter: current_user&.notes_filter_for(@merge_request),
|
|
notes_filters: UserPreference.notes_filters.to_json } }
|
|
#js-vue-discussion-counter
|
|
|
|
.tab-content#diff-notes-app
|
|
#js-diff-file-finder
|
|
#notes.notes.tab-pane.voting_notes
|
|
.row
|
|
%section.col-md-12
|
|
%script.js-notes-data{ type: "application/json" }= initial_notes_data(true).to_json.html_safe
|
|
.issuable-discussion.js-vue-notes-event
|
|
#js-vue-mr-discussions{ data: { notes_data: notes_data(@merge_request).to_json,
|
|
noteable_data: serialize_issuable(@merge_request),
|
|
noteable_type: 'MergeRequest',
|
|
target_type: 'merge_request',
|
|
help_page_path: suggest_changes_help_path,
|
|
current_user_data: UserSerializer.new(project: @project).represent(current_user, {}, MergeRequestUserEntity).to_json} }
|
|
|
|
#commits.commits.tab-pane
|
|
-# This tab is always loaded via AJAX
|
|
#pipelines.pipelines.tab-pane
|
|
- if @pipelines.any?
|
|
= render 'projects/commit/pipelines_list', disable_initialization: true, endpoint: pipelines_project_merge_request_path(@project, @merge_request)
|
|
#js-diffs-app.diffs.tab-pane{ data: { "is-locked" => @merge_request.discussion_locked?,
|
|
endpoint: diffs_project_merge_request_path(@project, @merge_request, 'json', request.query_parameters),
|
|
help_page_path: suggest_changes_help_path,
|
|
current_user_data: UserSerializer.new(project: @project).represent(current_user, {}, MergeRequestUserEntity).to_json,
|
|
project_path: project_path(@merge_request.project),
|
|
changes_empty_state_illustration: image_path('illustrations/merge_request_changes_empty.svg'),
|
|
is_fluid_layout: fluid_layout.to_s,
|
|
dismiss_endpoint: user_callouts_path,
|
|
show_suggest_popover: show_suggest_popover?.to_s } }
|
|
|
|
.mr-loading-status
|
|
= spinner
|
|
|
|
= render 'shared/issuable/sidebar', issuable_sidebar: @issuable_sidebar, assignees: @merge_request.assignees
|
|
|
|
- if @merge_request.can_be_reverted?(current_user)
|
|
= render "projects/commit/change", type: 'revert', commit: @merge_request.merge_commit, title: @merge_request.title
|
|
- if @merge_request.can_be_cherry_picked?
|
|
= render "projects/commit/change", type: 'cherry-pick', commit: @merge_request.merge_commit, title: @merge_request.title
|