Skip to content
Snippets Groups Projects
  1. Jan 28, 2020
  2. Dec 20, 2019
  3. Oct 22, 2019
  4. Sep 13, 2019
  5. Jul 19, 2019
  6. Jun 05, 2019
  7. May 06, 2019
  8. Mar 05, 2019
  9. Jul 27, 2018
  10. Jul 26, 2018
  11. Jul 24, 2018
  12. May 10, 2018
    • Bob Van Landuyt's avatar
      Allows `access_(git|api)` to anonymous users · d801dd17
      Bob Van Landuyt authored
      The `access_git` and `access_api` were currently never checked for
      anonymous users. And they would also be allowed access:
      
        An anonymous user can clone and pull from a public repo
      
        An anonymous user can request public information from the API
      
      So the policy didn't actually reflect what we were enforcing.
      d801dd17
    • Bob Van Landuyt's avatar
      Block access to API & git when terms are enforced · f7f13f9d
      Bob Van Landuyt authored
      When terms are enforced, but the user has not accepted the terms
      access to the API & git is rejected with a message directing the user
      to the web app to accept the terms.
      f7f13f9d
  13. Sep 29, 2017
  14. Sep 28, 2017
  15. Aug 01, 2017
  16. Jul 25, 2017
  17. Jul 03, 2017
  18. Jun 30, 2017
    • Timothy Andrew's avatar
      Implement review comments for !12445 from @godfat and @rymai. · 3c88a786
      Timothy Andrew authored
      - Use `GlobalPolicy` to authorize the users that a non-authenticated user can
        fetch from `/api/v4/users`. We allow access if the `Gitlab::VisibilityLevel::PUBLIC`
        visibility level is not restricted.
      
      - Further, as before, `/api/v4/users` is only accessible to unauthenticated users if
        the `username` parameter is passed.
      
      - Turn off `authenticate!` for the `/api/v4/users` endpoint by matching on the actual
        route + method, rather than the description.
      
      - Change the type of `current_user` check in `UsersFinder` to be more
        compatible with EE.
      3c88a786
  19. Jun 27, 2017
  20. Jun 15, 2017
  21. Apr 07, 2017
  22. Mar 09, 2017
  23. Aug 30, 2016
Loading