Commit Graph

465 Commits

Author SHA1 Message Date
Mayra Cabrera 3e619d1f9e Refactors rack attack requests spec
* Creates a shared_examples files under shared_examples/requests
* Moves web specs into the shared examples file
* Moves let definitions to the block that uses them
2019-09-05 21:15:55 +00:00
Brett Walker aa7b1cfc5b Upgrade GraphQL gem to 1.8.17
- Due to https://github.com/exAspArk/batch-loader/pull/32,
we  changed BatchLoader.for into BatchLoader::GraphQL.for
- since our results are wrapped in a BatchLoader::GraphQL,
calling `sync` during authorization is required to get real object
- `graphql` now has it's own authorization system.  Our
`authorized?` method conflicted and required renaming
2019-09-04 17:42:48 +00:00
Rémy Coutable fc6f8a6a44
Rename shared examples according to our guidelines
Signed-off-by: Rémy Coutable <remy@rymai.me>
2019-09-02 10:58:00 +02:00
Nick Thomas a8a10a0038 Merge branch 'improve-chatops-help' into 'master'
Improve chatops help output

See merge request gitlab-org/gitlab-ce!32208
2019-09-01 12:42:22 +00:00
Manoj MJ b943baa42a Limit access request email to 10 most recently active owners/maintainers
This change limits the number of emails
for new access requests notifications to
10 most recently active owners/maintainers
2019-08-30 21:30:51 +00:00
Robert Speicher 7698d40550
Merge branch 'master' of dev.gitlab.org:gitlab/gitlabhq 2019-08-29 17:17:37 -05:00
GitLab Release Tools Bot 34c2b6adf9 Merge branch 'security-personal-snippets' into 'master'
Add direct upload support for personal snippets

See merge request gitlab/gitlabhq!3226
2019-08-29 21:34:22 +00:00
GitLab Release Tools Bot b01c7ad291 Merge branch 'security-61974-limit-issue-comment-size' into 'master'
Limit the size of issuable description and comments

See merge request gitlab/gitlabhq!3267
2019-08-29 21:34:15 +00:00
GitLab Release Tools Bot 61c9f07802 Merge branch 'security-fix-markdown-xss' into 'master'
Re-escape the whole HTML content when finding HTML references

See merge request gitlab/gitlabhq!3340
2019-08-29 21:33:47 +00:00
Yorick Peterse e8dd299e7c
Improve chatops help output
This improves the output produced when running an unknown command,
running the "help" command, and when trying to run a command you are not
allowed to run. The new help output includes links to the project of the
chatops integration, and a link to the chatops documentation.
2019-08-29 16:11:42 +02:00
Luke Duncalfe a0b14c40dc CE-specific changes for designs `user_notes_count`
Notes call `#after_note_created` and `#after_note_destroyed` on their
noteable in callbacks, so the noteable can perform tasks particular to
them, like cache expiry.

This is in preparation of the EE-specific class
`DesignManagement::Design` clearing its `user_notes_count` cache when
its note are created or destroyed.

Refactoring Rspec behaviour testing of a counter caching service into a
shared example.

https://gitlab.com/gitlab-org/gitlab-ee/issues/13353
2019-08-27 20:50:26 +00:00
Patrick Derichs a13abd6731 Add edit_note and spec for editing quick actions
Call QuickActionsService on Note update

Add support for notes which just contain
commands after editing

Return http status gone (410) if note was deleted

Temporary frontend addition so it is not
failing when a note is deleted

Move specs to shared examples

Fix rubocop style issue

Deleting note on frontend when status is 410

Use guard clause for note which got deleted

Simplified condition for nil note

This method should no longer be called
with nil note

Refactoring of execute method to reduce
complexity

Move errors update to delete_note method

Note is now deleted visually when it only
contains commands after update

Add expectation

Fix style issues

Changing action to fix tests

Add tests for removeNote and update
deleteNote expectations
2019-08-26 09:20:00 +00:00
Marius Bobin 811252536d Read pipelines from public projects though API
Allow users to read pipelines for public projects
with public builds enabled without providing an access token.
2019-08-23 20:54:32 +00:00
Adam Hegyi 60e3388526 Implement validation logic to ProjectStage
- Introducting StageEvents to define the available events
- Define the event pairing rules, since some events are not compatible
- Express default Cycle Analytics stages with the event structure
2019-08-23 20:28:11 +00:00
Jan Provaznik 41d52bbfe9 Add direct upload support for personal snippets 2019-08-23 11:19:14 +02:00
Jan Provaznik a98b89e9bc Re-escape whole HTML content instead of only match
When we un-escape HTML text to find references in it, we should then
re-escape the whole text again, not only found matches.

Because we replace matches with milestone/label links (which contain
HTML tags we don't want to escape again), we re-escape HTML text
with placeholders instead of these links and then replace placeholders
in the escaped text.
2019-08-23 10:36:51 +02:00
Stan Hu e24b9c2502 Eliminate Gitaly N+1 queries with notes API
Similar to https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/31834,
we see that in https://gitlab.com/gitlab-org/gitlab-ce/issues/65957
there can be hundreds, even thousands, of Gitaly requests in the
`/api/:version/projects/:id/merge_requests/:noteable_id/notes` endpoint.

Previously, the API to retrieve notes generated hundreds of Gitaly calls
to determine whether a system note should be shown to the user. It did
this by:

1. Rendering the Markdown
2. Extracting cross-references from the Markdown
3. Issuing a Gitaly `FindCommit` RPC for every reference to validate
that the commit exists.

The last step is unnecessary because we don't need to display a commit
if the user doesn't have access to the project in the first place.
`RendersNotes#prepare_notes_for_rendering` is already used in
`MergeRequestsController`, which is why we don't see N+1 Gitaly calls
there. We use it here to optimize the note redaction process.
2019-08-22 22:28:47 -07:00
Alexandru Croitor 5af535d919 Limit the size of issuable description and comments
Limiting the size of issuable description and comments to 1_000_000,
which is close to ~1MB of ASCII characters, which represents 99.9% of
all descriptions and comments we have in DB at the moment. This should
help prevent DoS attacks when comments contain refference strings.

Also this change updates regexp matching the namespaces paths by
limiting the namespaces paths to Namespace::NUMBER_OF_ANCESTORS_ALLOWED,
as we allow 20 levels deep groups.

see https://gitlab.com/gitlab-org/gitlab-ce/issues/61974#note_191274234
2019-08-22 10:43:13 +03:00
George Koltsov 8bcc47ac02 Add SortingPreference concern
Sorting preference functionality has been extracted
from `IssuableCollections` to a new `SortingPreference`
concern in order to reuse this functionality in projects
(and groups in the future).
2019-08-21 10:13:45 +00:00
Luke Duncalfe 37b17fa61a Add service classes for mutating AwardEmoji
Adding, destroying and toggling emoji previously lacked services and
instead were performed through methods called on Awardable models.

This led to inconsistencies where relevant todos would be marked as done
only when emoji were awarded through our controllers, but not through
the API. Todos could also be marked as done when an emoji was being
removed.

Behaviour changes

- Awarding emoji through the API will now mark a relevant Todo as done
- Toggling an emoji off (destroying it) through our controllers will no
  longer mark a relevant Todo as done

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/63372
2019-08-21 11:39:41 +12:00
Vitali Tatarintev 6a6411938a Change `be_success` to `be_successful` in specs
Fixes deprecation warning:

```
DEPRECATION WARNING: The success? predicate is deprecated and
will be removed in Rails 6.0.
Please use successful? as provided by Rack::Response::Helpers.
```
2019-08-19 14:40:56 +02:00
Felipe Artur 01b2342292 Add feature specs for multiple group issue boards
Add feature specs for multiple issue boards for groups
2019-08-16 06:34:55 +00:00
Brett Walker 3489dc3d72 Allow disabling group/project email notifications
- Adds UI to configure in group and project settings
- Removes notification configuration for users when
disabled at group or project level
2019-08-15 17:37:36 +00:00
John T Skarbek 2b2efbc609
Merge remote-tracking branch 'dev/security-2873-restrict-slash-commands-to-users-who-can-log-in' 2019-08-14 14:11:04 -04:00
Bob Van Landuyt 3770f3fb30 Merge branch 'spec_cluster_policy_coverage' into 'master'
Improve cluster policy spec coverage

See merge request gitlab-org/gitlab-ce!31700
2019-08-13 09:14:06 +00:00
Heinrich Lee Yu 7a6ecbcb18 Improve quick action error messages
Standardize punctuation and format
2019-08-13 00:40:39 +00:00
Thong Kuah b56f285012 Improve cluster policy spec coverage 2019-08-12 12:04:55 +12:00
Heinrich Lee Yu b4b1f69a0b Remove default relative_position value
This makes `epic_issues` consistent with other tables
using our `RelativePositioning` class
2019-08-09 10:04:08 +08:00
Heinrich Lee Yu b689ddd9b6 Do not persist notes filter when auto-switching
Send a `persist_filter: false` param to backend when
opening links to notes and auto-switching to show
all notes
2019-08-07 15:45:23 +00:00
Steve Abrams 3dbf3997bb Add group level container repository endpoints
API endpoints for requesting container repositories
and container repositories with their tag information
are enabled for users that want to specify the group
containing the repository rather than the specific project.
2019-08-05 20:00:50 +00:00
Heinrich Lee Yu 3f9b1ecdb3 Use SQL to find the gap instead of iterating
Also removes unnecessary methods causing extra queries
2019-08-05 17:49:24 +08:00
Jan Provaznik afbe0b616b Optimize rebalancing of relative positioning
Moving of neighbour items was done recursively - this
was extremely expensive when multiple items had to be moved.

This change optimizes the code to find nearest possible gap where
items can be moved and moves all of them with single update query.
2019-08-05 17:49:04 +08:00
Rémy Coutable f74387d298 Merge branch 'georgekoltsov/55474-outbound-setting-system-hooks' into 'master'
Add outbound setting for system hooks

See merge request gitlab-org/gitlab-ce!31177
2019-08-05 08:55:16 +00:00
Bob Van Landuyt dd05aed1d3 Merge branch '64092-removes-update-statistics-namespace-feature-flag' into 'master'
Removes update_statistics_namespace feature flag

See merge request gitlab-org/gitlab-ce!31392
2019-08-02 17:39:03 +00:00
George Koltsov 8abf920d1f Refactor SystemHookUrlValidator and specs
Simplify SystemHookUrlValidator to inherit from PublicUrlValidator
Refactor specs to move out shared examples to be used in both
system hooks and public url validators.
2019-08-02 15:39:18 +01:00
Lukas '+ alert('Eipi') + ' Eipert fc9f099884 Prevent empty classes in ansi2html conversion
Currently we write out empty CSS classes (`class=""`) every time we
create a new tag. This adds 9 unnecessary bytes per span element. In a
recent trace, I have counted 11950 span elements. So we transported 105
unnecessary kilobytes!
2019-08-02 14:38:50 +00:00
Mayra Cabrera c6acb77d8a Removes update_statistics_namespace feature flag
After measuring the impact of the namespace storage on
https://gitlab.com/gitlab-org/gitlab-ce/issues/64092. It was decided
that it's performant enough. So we can freely remove the feature flag

Related to https://gitlab.com/gitlab-org/gitlab-ce/issues/64092
2019-08-02 09:29:29 -05:00
Patrick Bajao 70626f324b Make diff_refs_match_commit validation reusable
Move it to DiffPositionableNote concern which will be re-used
in EE in DraftNote model.
2019-08-01 16:00:36 -05:00
Robert Speicher 5b38fced90 Merge branch 'bvl-fix-relative-positioning-rename-ce' into 'master'
Skip specs for default relative positions

See merge request gitlab-org/gitlab-ce!31390
2019-08-01 16:51:11 +00:00
Stan Hu dbc6c24403 Merge branch '52123-issuable-actions-notesfinder-pderichs' into 'master'
Use NotesFinder to fetch notes on API and Controllers

Closes #52123

See merge request gitlab-org/gitlab-ce!31300
2019-08-01 16:27:02 +00:00
Bob Van Landuyt e3dd1adafa Skip specs for default relative positions
If a model has a default relative position we don't need to test that
it is moved to the end, it will instead get the default value assigned.
2019-08-01 18:11:20 +02:00
Bob Van Landuyt fc09bb0770 Merge branch 'rename-relative-position-move-to-end' into 'master'
Fix bug when moving batches of items to the end

See merge request gitlab-org/gitlab-ce!31351
2019-08-01 12:41:42 +00:00
Patrick Derichs 0e99daae4a Use NotesFinder in IssuableActions module
Remove project from NotesFinder constructor

Add project parameter to specs

Also look for methods in private scope

Fix specs to match new NotesFinder constructor
2019-08-01 10:42:42 +02:00
Heinrich Lee Yu 8992013689 Fix bug when moving batches of items to the end
Starts from START_POSITION when there are no existing
positions.

Also improves the test to actually test the behavior
2019-08-01 02:04:10 +08:00
Reuben Pereira f5213a38cc Add prometheus listen address to whitelist
- Add to whitelist so that even if local requests from hooks and
services are not allowed, the prometheus manual configuration will
still succeed.
2019-07-31 17:38:15 +00:00
Reuben Pereira 5c7f2853dc Allow blank but not nil in validations
- The most common use case for qualified_domain_validator currently is
to allow blank ([]) but not allow nil. Modify the
qualified_domain_validator to support this use case.
2019-07-31 06:54:03 +00:00
🙈 jacopo beschi 🙉 c96e125700 Make quick action "commands applied" banner more useful
Extends the quick actions "commands applied" banner to show
the quick action preview text, but with everything in past tense.
2019-07-29 22:35:29 +00:00
Mayra Cabrera a8b29b78ca Merge branch 'tp-qtt182-2' into 'master'
Change qa-* class references to rspec-* for `allowed-to-{push|merge}-dropdown`

Closes gitlab-org/quality/team-tasks#182

See merge request gitlab-org/gitlab-ce!31203
2019-07-29 19:12:23 +00:00
Robert Speicher fe22704a20
Merge branch 'master' of dev.gitlab.org:gitlab/gitlabhq 2019-07-29 13:19:50 -05:00
Stan Hu c41788fe54 Revert "Merge branch '52123-issuable-actions-notesfinder-pderichs' into 'master'"
This reverts merge request !29733
2019-07-27 04:28:56 +00:00