[ci skip]

[ci skip]

[ci skip]

Security check validity of repository mirror urls

See merge request gitlab-org/security/gitlab!833

Add scopes presence validation on OAuth Application creation

See merge request gitlab-org/security/gitlab!907

Previously if the import URL contained passwords that may look like
hostnames or ports when unescaped, `Addressable::URI` would fail to
parse.

Since we really don't care about the username/password component, remove
them from Gitlab::UrlSanitizer and then check the resulting value.

For security reasons, we need to check the validity of remote URLs to
avoid users specifying blocked URLs (such as localhost)

George Koltsov authored 4 years ago and Drew Blessing committed 4 years ago

- Update OAuth Applications controllers to disallow empty scopes
  application creation

2FA requirement bypass using the API

See merge request gitlab-org/security/gitlab!876

mksionek authored 4 years ago and GitLab Release Tools Bot committed 4 years ago

Change the way of treating nil current user

Add specs to new class

Add changelog entry

Add specs for new auth method

Rename Verificator to verifier

Rename method in verifier

Add cr remarks

Add cr remarks

Set maximum limit for profile events

See merge request gitlab-org/security/gitlab!879

GitLab Runner version upgrade

See merge request gitlab-org/security/gitlab!886

Malicious user can block gitlab.com users by exploiting 2FA inheritance logic

See merge request gitlab-org/security/gitlab!801

Previously created sessions remain active after activating 2FA

See merge request gitlab-org/security/gitlab!865

Delete members invites created by users being deleted

See merge request gitlab-org/security/gitlab!830

Pre-generation & Static 2FA Authenticator Secret Code can cause risks to accounts

See merge request gitlab-org/security/gitlab!808

Disabled Repository functionality - Still Able To Access The Project Files and Container Registry via Deploy Token

See merge request gitlab-org/security/gitlab!889

Improper Access Control on Deploy-Key

See merge request gitlab-org/security/gitlab!892

Validate Snippet global id in GraphQL destroy mutation

See merge request gitlab-org/security/gitlab!730

Merge branch 'security-220-dblessing-revoke-remember-me-on-session-revocation-13-1' into '13-1-stable-ee'

Invalidate remember me when an active session is revoked

See merge request gitlab-org/security/gitlab!855

Rate limit on webhooks testing feature

See merge request gitlab-org/security/gitlab!827

Upgrade jQuery to v3.5

See merge request gitlab-org/security/gitlab!834

Don't expose epic for users without permissions

See merge request gitlab-org/security/gitlab!788

Prevent OmniAuth from rendering arbitrary error messages

See merge request gitlab-org/security/gitlab!849

Invalidate two factor sign-in when user password changes

See merge request gitlab-org/security/gitlab!846

Prevent stale otp_user_id from signing-in incorrect user

See merge request gitlab-org/security/gitlab!852

Security websocket extensions update

See merge request gitlab-org/security/gitlab!750

Prevent project maintainers from editing group badges

See merge request gitlab-org/security/gitlab!796

Change conan api to use proper workhorse validation

See merge request gitlab-org/security/gitlab!766

Allow tokens only from running jobs for API auth

See merge request gitlab-org/security/gitlab!709

Sanitize vulnerability history comment

See merge request gitlab-org/security/gitlab!682

Persist EKS External ID before presenting it to the user

See merge request gitlab-org/security/gitlab!785

This commit fixes the vulnerability on the deploy key.

This commit prevents it from access when the repository is disabled

We are previously allowing to request for profile events with
unlimited `limit`. That can result to possible DoS since a
malicious user can request 1k events and it'll take a while to
respond.

Maximum limit is based on the existing `Kaminari.max_per_page`
setting we have.

Adds a finder class used for authentication with CI job tokens.
It checks that the job's status is `running` and that the project
is not removed.