Skip to content
Snippets Groups Projects
  1. Mar 16, 2020
  2. Sep 06, 2019
  3. Sep 04, 2019
  4. Jan 05, 2019
    • Stan Hu's avatar
      Fix multipart attachments not uploading · 7d28e39f
      Stan Hu authored
      Mixing and matching the use of Rack::Request and ActionDispatch::Request
      in Rails 5 is bad, particularly if you have middleware that
      manipulates or accesses environment variables.
      
      `Gitlab::Middleware::Multipart` attempts to rewrite request parameters
      to the proper values (e.g. replacing `data_file` with
      `UploadedFile`). It does this by calling `Rack::Request#update_params`,
      which essentially updates `env['rack.request.form_hash']`.
      
      By changing to `ActionDispatch::Request`, the Go middleware was causing
      the request parameters to be stored inside
      `env['action_dispatch.request.request_parameters']`. Later calls to
      `Rack::Request#update_params` would not have any effect because it would
      attempt to update `env['rack.request.form_has']` instead of
      `env['action_dispatch.request.request_parameters']`. As a result, the
      controller still saw the old parameters.
      
      Since the Go middleware appears to be using `ActionDispatch::Request`
      for authorization methods, we can switch the multipart middleware to
      use it too.
      
      Closes https://gitlab.com/gitlab-org/gitlab-ee/issues/9035
      7d28e39f
  5. Nov 17, 2018
    • gfyoung's avatar
      Enable even more frozen string for lib/gitlab · 7ec8af50
      gfyoung authored
      Enables frozen string for the following:
      
      * lib/gitlab/hook_data/**/*.rb
      * lib/gitlab/i18n/**/*.rb
      * lib/gitlab/import/**/*.rb
      * lib/gitlab/import_export/**/*.rb
      * lib/gitlab/kubernetes/**/*.rb
      * lib/gitlab/legacy_github_import/**/*.rb
      * lib/gitlab/manifest_import/**/*.rb
      * lib/gitlab/metrics/**/*.rb
      * lib/gitlab/middleware/**/*.rb
      
      Partially addresses gitlab-org/gitlab-ce#47424.
      7ec8af50
  6. Sep 05, 2018
  7. Aug 21, 2018
    • Jan Provaznik's avatar
      Add public/uploads/tmp to allowed upload paths · 4ca9f3b4
      Jan Provaznik authored
      When direct_upload is enabled and a for file is being uploaded,
      then workhorse uses `public/uploads/tmp` path. If `uploads.storage_path`
      i sset to a different directory, then upload fails because
      `public/uploads/tmp` is not in allowed paths.
      4ca9f3b4
  8. Jul 08, 2018
    • Jan Provaznik's avatar
      Add FileUploader.root to allowed upload paths · e2ec97a9
      Jan Provaznik authored
      Currently we check if uploaded file is under
      `Gitlab.config.uploads.storage_path`, the problem is that
      uploads are placed in `uploads` subdirectory which is symlink.
      
      In allow_path? method we check real (expanded) paths, which causes
      that `Gitlab.config.uploads.storage_path` is expaned into symlink
      path and there is a mismatch with upload file path.
      
      By adding `Gitlab.config.uploads.storage_path/uploads` into allowed
      paths, this path is expaned during path check.
      
      `Gitlab.config.uploads.storage_path` is left there intentionally in case
      some uploader wouldn't use `uploads` subdir.
      e2ec97a9
  9. Jun 27, 2018
  10. Apr 05, 2018
  11. Feb 12, 2018
    • Alessio Caiazza's avatar
      Honour workhorse provided file name · 34c2a59c
      Alessio Caiazza authored
      In the attempt to unify file uploading at workhorse level gitlab-org/gitlab-workhorse!230
      we moved to a prefix-based tempfile creation in order to avoid upload collisions.
      
      Artifacts and LFS uploads already set original_filename to workhorse provided filename
      
      This commit add the same feature to `Gitlab::Middleware::Multipart`
      Unverified
      34c2a59c
  12. Jan 11, 2018
  13. Feb 23, 2017
  14. Dec 21, 2016
  15. Dec 15, 2016
Loading