Skip to content
Snippets Groups Projects
  1. Feb 24, 2020
  2. Feb 13, 2020
  3. Dec 11, 2019
  4. Dec 06, 2019
  5. Dec 03, 2019
  6. Nov 26, 2019
  7. Nov 22, 2019
  8. Oct 31, 2019
  9. Oct 30, 2019
  10. Oct 14, 2019
  11. Oct 09, 2019
  12. Sep 16, 2019
  13. Sep 10, 2019
  14. Sep 06, 2019
  15. Sep 03, 2019
  16. Aug 28, 2019
  17. Aug 12, 2019
  18. Aug 07, 2019
    • Stan Hu's avatar
      Add support for Content-Security-Policy · 5fbbd3dd
      Stan Hu authored and Ash McKenzie's avatar Ash McKenzie committed
      A nonce-based Content-Security-Policy thwarts XSS attacks by allowing
      inline JavaScript to execute if the script nonce matches the header
      value. Rails 5.2 supports nonce-based Content-Security-Policy headers,
      so provide configuration to enable this and make it work.
      
      To support this, we need to change all `:javascript` HAML filters to the
      following form:
      
      ```
      = javascript_tag nonce: true do
        :plain
          ...
      ```
      
      We use `%script` throughout our HAML to store JSON and other text, but
      since this doesn't execute, browsers don't appear to block this content
      from being used and require the nonce value to be present.
      Unverified
      5fbbd3dd
  19. Jul 27, 2019
  20. Jul 19, 2019
  21. Jul 10, 2019
  22. Jun 24, 2019
  23. Jun 20, 2019
    • Stan Hu's avatar
      Omit issues links in merge request entity API response · 1b7ab11f
      Stan Hu authored
      The merge request widget has a section that includes which issues may be
      closed or mentioned based on the merge request description. The problem
      is that rendering and redacting Markdown can be expensive, especially
      since the browser polls for the data every 10 seconds.
      
      Since these links don't change much and are just nice to have, we only
      load them on first page load. The frontend will use the existing data if
      the data doesn't appear on subsequent requests.
      
      This saves about 30% of the rendering time of this endpoint, which adds
      up to significant savings considering that
      `MergeRequestsController#show.json` is called over a million times a day
      on GitLab.com.
      
      Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/63546
      1b7ab11f
  24. Jun 17, 2019
  25. Jun 14, 2019
  26. Jun 06, 2019
  27. Apr 25, 2019
  28. Apr 23, 2019
    • Jan Provaznik's avatar
      Move scoped_label into label presenter · 8ce4b609
      Jan Provaznik authored
      When rendering a label we want to check 'scoped_label' feature
      availability on a project/group where label is being used. For
      this reason a label presenter is used in UI and information about
      context project/group is passed to this presenter.
      8ce4b609
  29. Apr 12, 2019
  30. Apr 08, 2019
  31. Mar 26, 2019
  32. Mar 11, 2019
  33. Mar 08, 2019
  34. Mar 07, 2019
  35. Feb 26, 2019
Loading