gitlab-org--gitlab-foss/app/controllers
Douwe Maan 742cee756b Merge branch 'jej-22869' into 'security'
Fix information disclosure in `Projects::BlobController#update`

It was possible to discover private project names by modifying `from_merge_request`parameter in `Projects::BlobController#update`. This fixes that.

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.md) entry added
- Tests
  - [x] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

https://gitlab.com/gitlab-org/gitlab-ce/issues/22869

See merge request !2023
2016-11-28 21:25:18 -03:00
..
admin Allow the Sidekiq queues to throttle and the factor by which to throttle them to be configurable 2016-11-10 11:38:11 -06:00
ci Remove Ci::ApplicationController 2016-10-10 16:47:27 +02:00
concerns Ensure user is authenticated to create a new snippet 2016-11-28 16:57:49 +01:00
dashboard Limit what label fields we expose on Dashboard::LabelsController#index 2016-10-19 14:58:26 -02:00
explore Precalculate trending projects 2016-10-10 12:27:08 +02:00
groups Add a starting date to milestones 2016-11-23 13:41:04 +02:00
import Merge branch 'security-fix-leaking-namespace-name' into 'security' 2016-10-24 15:49:05 +02:00
oauth Fix endless redirections when accessing user OAuth applications when they are disabled 2016-06-08 05:52:04 -07:00
profiles Remove event caching code 2016-11-23 14:17:07 +01:00
projects Merge branch 'jej-22869' into 'security' 2016-11-28 21:25:18 -03:00
sherlock
abuse_reports_controller.rb
application_controller.rb Merge branch 'dz-allow-nested-group-routing' into 'master' 2016-11-24 04:31:54 +00:00
autocomplete_controller.rb Improved Ruby code in autocomplete user search 2016-11-18 16:10:48 +00:00
confirmations_controller.rb Enable Style/EmptyLines cop, remove redundant ones 2016-07-01 21:56:17 +02:00
dashboard_controller.rb Restrict starred projects to viewable ones 2016-05-10 18:13:52 +01:00
emojis_controller.rb
groups_controller.rb Syntax fixes and better tests for helper methods. Updated docs. 2016-09-15 14:10:49 -05:00
health_check_controller.rb Support token header for health check token, and general cleanup of the health_check feature. 2016-05-11 17:27:08 -07:00
help_controller.rb Fix broken external links in help/index.html 2016-11-20 20:15:08 +01:00
invites_controller.rb Enable Style/EmptyLines cop, remove redundant ones 2016-07-01 21:56:17 +02:00
jwt_controller.rb Merge branch 'unauthenticated-container-registry-access' into 'security' 2016-11-09 12:28:29 +01:00
koding_controller.rb Split Koding admin/user docs 2016-08-22 17:09:15 +03:00
notification_settings_controller.rb merge master into issue_3359_3 2016-06-29 11:04:18 -03:00
omniauth_callbacks_controller.rb Added tests for 2FA check on OAuth request 2016-07-04 11:00:34 -05:00
passwords_controller.rb
profiles_controller.rb implements reset incoming email token on issues modal and account page, 2016-11-07 15:56:18 +00:00
projects_controller.rb Revert "Merge branch '22680-unlabel-limit-autocomplete-to-selected-items' into 'master'" 2016-11-17 09:39:23 +00:00
registrations_controller.rb Enable Style/SpaceAroundEqualsInParameterDefault cop 2016-08-06 04:03:01 +02:00
root_controller.rb
search_controller.rb Fix broken commits search 2016-11-08 12:03:23 +02:00
sent_notifications_controller.rb Remove default value for `project` argument on subscribable concern 2016-11-17 15:10:13 -02:00
sessions_controller.rb Remove provider path, replace with dynamic path. 2016-08-03 11:50:38 -06:00
snippets_controller.rb Added 'Download' button to snippet view 2016-10-11 15:36:59 -04:00
uploads_controller.rb
users_controller.rb Check all namespaces on validation of new username. 2016-11-17 19:59:03 +01:00