f5576b16ba
Correct namespace validation to forbid bad names #21077 ## What does this MR do? Updates master namespace regex to forbid any namespace ending in `.git` or `.atom` and corrects and adds relevant tests ## Are there points in the code the reviewer needs to double check? I think it's all good. I could use help with the creation of tests for usernames with trailing `.atom` or `.git` as the testing framework is a bit over my head. ## Why was this MR needed? A group that ends in `.atom` will cause the relevent dashboard to crash if the user (ANY user, not just the creator) has visibility of the group until it is deleted through the admin panel (it cannot be renamed, the edit page will crash. It may be fixable through the API, that wasn't checked.) This allows a malicious user with group creation privileges to bulk add users to a group, rename the group to a bad name, and crash the groups dashboard for all members of the group. The same applies if the group is internal or public and users navigate to the explore tab of the groups dashboard. The same applies to usernames ending in `.atom`. In many places of the code, it implies that `.git` in not allowed at the end of namespaces, but many allowed it anyway. This MR forbids it everywhere to prevent potential issues (like the one with `.atom` going forward). ## What are the relevant issue numbers? Group path validation incomplete, crashes groups dashboard #21077 ## Does this MR meet the acceptance criteria? - [X] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added - [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md) - [ ] API support added - Tests - [X] Added for this feature/bug - [X] All builds are passing - [X] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides) - [X] Branch has no merge conflicts with `master` (if you do - rebase it please) - [X] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits) See merge request !5994 |
||
|---|---|---|
| .github | ||
| .gitlab | ||
| app | ||
| bin | ||
| builds | ||
| changelogs | ||
| config | ||
| db | ||
| doc | ||
| docker | ||
| features | ||
| fixtures/emojis | ||
| generator_templates/active_record/migration | ||
| lib | ||
| log | ||
| public | ||
| rubocop | ||
| scripts | ||
| shared | ||
| spec | ||
| tmp | ||
| vendor | ||
| .csscomb.json | ||
| .flayignore | ||
| .foreman | ||
| .gitattributes | ||
| .gitignore | ||
| .gitlab-ci.yml | ||
| .haml-lint.yml | ||
| .mailmap | ||
| .pkgr.yml | ||
| .rspec | ||
| .rubocop.yml | ||
| .rubocop_todo.yml | ||
| .ruby-version | ||
| .scss-lint.yml | ||
| .vagrant_enabled | ||
| CHANGELOG | ||
| config.ru | ||
| CONTRIBUTING.md | ||
| doc_styleguide.md | ||
| docker-compose.yml | ||
| Gemfile | ||
| Gemfile.lock | ||
| GITLAB_SHELL_VERSION | ||
| GITLAB_WORKHORSE_VERSION | ||
| LICENSE | ||
| MAINTENANCE.md | ||
| PROCESS.md | ||
| Procfile | ||
| Rakefile | ||
| README.md | ||
| VERSION | ||
GitLab
Canonical source
The canonical source of GitLab Community Edition is hosted on GitLab.com.
Open source software to collaborate on code
To see how GitLab looks please see the features page on our website.
- Manage Git repositories with fine grained access controls that keep your code secure
- Perform code reviews and enhance collaboration with merge requests
- Each project can also have an issue tracker and a wiki
- Used by more than 100,000 organizations, GitLab is the most popular solution to manage Git repositories on-premises
- Completely free and open source (MIT Expat license)
- Powered by Ruby on Rails
Hiring
We're hiring developers, support people, and production engineers all the time, please see our jobs page.
Editions
There are two editions of GitLab:
- GitLab Community Edition (CE) is available freely under the MIT Expat license.
- GitLab Enterprise Edition (EE) includes extra features that are more useful for organizations with more than 100 users. To use EE and get official support please become a subscriber.
Website
On about.gitlab.com you can find more information about:
- Subscriptions
- Consultancy
- Community
- Hosted GitLab.com use GitLab as a free service
- GitLab Enterprise Edition with additional features aimed at larger organizations.
- GitLab CI a continuous integration (CI) server that is easy to integrate with GitLab.
Requirements
Please see the requirements documentation for system requirements and more information about the supported operating systems.
Installation
The recommended way to install GitLab is with the Omnibus packages on our package server. Compared to an installation from source, this is faster and less error prone. Just select your operating system, download the respective package (Debian or RPM) and install it using the system's package manager.
There are various other options to install GitLab, please refer to the installation page on the GitLab website for more information.
You can access a new installation with the login root and password 5iveL!fe, after login you are required to set a unique password.
Install a development environment
To work on GitLab itself, we recommend setting up your development environment with the GitLab Development Kit. If you do not use the GitLab Development Kit you need to install and setup all the dependencies yourself, this is a lot of work and error prone. One small thing you also have to do when installing it yourself is to copy the example development unicorn configuration file:
cp config/unicorn.rb.example.development config/unicorn.rb
Instructions on how to start GitLab and how to run the tests can be found in the development section of the GitLab Development Kit.
Software stack
GitLab is a Ruby on Rails application that runs on the following software:
- Ubuntu/Debian/CentOS/RHEL
- Ruby (MRI) 2.3
- Git 2.7.4+
- Redis 2.8+
- MySQL or PostgreSQL
For more information please see the architecture documentation.
Third-party applications
There are a lot of third-party applications integrating with GitLab. These include GUI Git clients, mobile applications and API wrappers for various languages.
GitLab release cycle
For more information about the release process see the release documentation.
Upgrading
For upgrading information please see our update page.
Documentation
All documentation can be found on doc.gitlab.com/ce/.
Getting help
Please see Getting help for GitLab on our website for the many options to get help.
Is it any good?
Is it awesome?
Thanks for asking this question Joshua. These people seem to like it.