Skip to content
Snippets Groups Projects
  1. Jan 28, 2020
  2. Oct 22, 2019
  3. Sep 13, 2019
  4. Jul 19, 2019
  5. Jun 05, 2019
  6. May 06, 2019
  7. Mar 05, 2019
  8. Jul 27, 2018
  9. Jul 26, 2018
  10. Jul 24, 2018
  11. May 10, 2018
    • Bob Van Landuyt's avatar
      Allows `access_(git|api)` to anonymous users · d801dd17
      Bob Van Landuyt authored
      The `access_git` and `access_api` were currently never checked for
      anonymous users. And they would also be allowed access:
      
        An anonymous user can clone and pull from a public repo
      
        An anonymous user can request public information from the API
      
      So the policy didn't actually reflect what we were enforcing.
      d801dd17
    • Bob Van Landuyt's avatar
      Block access to API & git when terms are enforced · f7f13f9d
      Bob Van Landuyt authored
      When terms are enforced, but the user has not accepted the terms
      access to the API & git is rejected with a message directing the user
      to the web app to accept the terms.
      f7f13f9d
  12. Sep 29, 2017
  13. Sep 28, 2017
  14. Aug 01, 2017
  15. Jul 25, 2017
  16. Jul 03, 2017
  17. Jun 30, 2017
    • Timothy Andrew's avatar
      Implement review comments for !12445 from @godfat and @rymai. · 3c88a786
      Timothy Andrew authored
      - Use `GlobalPolicy` to authorize the users that a non-authenticated user can
        fetch from `/api/v4/users`. We allow access if the `Gitlab::VisibilityLevel::PUBLIC`
        visibility level is not restricted.
      
      - Further, as before, `/api/v4/users` is only accessible to unauthenticated users if
        the `username` parameter is passed.
      
      - Turn off `authenticate!` for the `/api/v4/users` endpoint by matching on the actual
        route + method, rather than the description.
      
      - Change the type of `current_user` check in `UsersFinder` to be more
        compatible with EE.
      3c88a786
  18. Jun 27, 2017
  19. Jun 15, 2017
  20. Apr 07, 2017
  21. Mar 09, 2017
  22. Aug 30, 2016
Loading