Skip to content
Snippets Groups Projects
  1. Jul 27, 2018
  2. Jul 26, 2018
  3. Jul 24, 2018
  4. May 10, 2018
    • Bob Van Landuyt's avatar
      Allows `access_(git|api)` to anonymous users · d801dd17
      Bob Van Landuyt authored
      The `access_git` and `access_api` were currently never checked for
      anonymous users. And they would also be allowed access:
      
        An anonymous user can clone and pull from a public repo
      
        An anonymous user can request public information from the API
      
      So the policy didn't actually reflect what we were enforcing.
      d801dd17
    • Bob Van Landuyt's avatar
      Block access to API & git when terms are enforced · f7f13f9d
      Bob Van Landuyt authored
      When terms are enforced, but the user has not accepted the terms
      access to the API & git is rejected with a message directing the user
      to the web app to accept the terms.
      f7f13f9d
  5. Sep 29, 2017
  6. Sep 28, 2017
  7. Aug 01, 2017
  8. Jul 25, 2017
  9. Jul 03, 2017
  10. Jun 30, 2017
    • Timothy Andrew's avatar
      Implement review comments for !12445 from @godfat and @rymai. · 3c88a786
      Timothy Andrew authored
      - Use `GlobalPolicy` to authorize the users that a non-authenticated user can
        fetch from `/api/v4/users`. We allow access if the `Gitlab::VisibilityLevel::PUBLIC`
        visibility level is not restricted.
      
      - Further, as before, `/api/v4/users` is only accessible to unauthenticated users if
        the `username` parameter is passed.
      
      - Turn off `authenticate!` for the `/api/v4/users` endpoint by matching on the actual
        route + method, rather than the description.
      
      - Change the type of `current_user` check in `UsersFinder` to be more
        compatible with EE.
      3c88a786
  11. Jun 27, 2017
  12. Jun 15, 2017
  13. Apr 07, 2017
  14. Mar 09, 2017
  15. Aug 30, 2016
Loading