742cee756b
Fix information disclosure in `Projects::BlobController#update` It was possible to discover private project names by modifying `from_merge_request`parameter in `Projects::BlobController#update`. This fixes that. - [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.md) entry added - Tests - [x] Added for this feature/bug - [ ] All builds are passing - [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html) - [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides) - [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits) https://gitlab.com/gitlab-org/gitlab-ce/issues/22869 See merge request !2023
31 lines
1.6 KiB
Text
31 lines
1.6 KiB
Text
- @no_container = true
|
|
- page_title "Edit", @blob.path, @ref
|
|
- content_for :page_specific_javascripts do
|
|
= page_specific_javascript_tag('lib/ace.js')
|
|
= page_specific_javascript_tag('blob_edit/blob_edit_bundle.js')
|
|
= render "projects/commits/head"
|
|
|
|
%div{ class: container_class }
|
|
- if @conflict
|
|
.alert.alert-danger
|
|
Someone edited the file the same time you did. Please check out
|
|
= link_to "the file", namespace_project_blob_path(@project.namespace, @project, tree_join(@target_branch, @file_path)), target: "_blank"
|
|
and make sure your changes will not unintentionally remove theirs.
|
|
|
|
.file-editor
|
|
%ul.nav-links.no-bottom.js-edit-mode
|
|
%li.active
|
|
= link_to '#editor' do
|
|
Edit File
|
|
|
|
%li
|
|
= link_to '#preview', 'data-preview-url' => namespace_project_preview_blob_path(@project.namespace, @project, @id) do
|
|
= editing_preview_title(@blob.name)
|
|
|
|
= form_tag(namespace_project_update_blob_path(@project.namespace, @project, @id), method: :put, class: 'form-horizontal js-quick-submit js-requires-input js-edit-blob-form', data: blob_editor_paths) do
|
|
= render 'projects/blob/editor', ref: @ref, path: @path, blob_data: @blob.data
|
|
= render 'shared/new_commit_form', placeholder: "Update #{@blob.name}"
|
|
= hidden_field_tag 'last_commit_sha', @last_commit_sha
|
|
= hidden_field_tag 'content', '', id: "file-content"
|
|
= hidden_field_tag 'from_merge_request_iid', params[:from_merge_request_iid]
|
|
= render 'projects/commit_button', ref: @ref, cancel_path: namespace_project_blob_path(@project.namespace, @project, @id)
|