[master] Resolve "Personal access token with only `read_user` scope can be used to authenticate any web request"
See merge request gitlab/gitlabhq!2583
Rails 5.0 requires to explicitly permit attributes when building a URL
using current `params` object.
The `safe_params` helper allows developers to just call `safe_params.merge(...)`
instead of manually adding `permit` to every call.
https://github.com/rails/rails/pull/20868
In order to avoid string manipulation or modify route params (to make them unambiguous for `url_for`), we are accepting a behavior change:
When being redirected to the canonical path for a group, if you requested a group show path starting with `/groups/…` then you’ll now be redirected to the group at root `/…`.
Note: This changes the behavior of user lookups (see the spec change) so it acts the same way as groups and projects. Unauthenticated clients attempting to access a user page will be redirected to login whether the user exists and is publicly restricted, or does not exist at all.
Extended ProjectFinder in order to handle the following options:
- current_user - which user use
- project_ids_relation: int[] - project ids to use
- params:
- trending: boolean
- non_public: boolean
- starred: boolean
- sort: string
- visibility_level: int
- tags: string[]
- personal: boolean
- search: string
- non_archived: boolean
GroupProjectsFinder now inherits from ProjectsFinder.
Changed the code in order to use the new available options.
Respect project visibility settings in the contributions calendar
This MR fixes a number of bugs relating to access controls and date selection of events for the contributions calendar
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/23403
See merge request !2019
Signed-off-by: Rémy Coutable <remy@rymai.me>
- Tab between register and sign in forms
- Add individual input validation error messages
- Validate username
- Update many styles for all login-box forms
For some reason, GoogleBot accesses /u/:username/calendar_activities without
a :date param, but then the view was trying to call #to_s(:short) which
doesn't exist on nil, leading to the following Sentry report:
https://sentry.gitlap.com/gitlab/gitlabcom/issues/1182/
Martin Wortschack
Cindy Pallares
gfyoung
JX Terry
blackst0ne
Bob Van Landuyt
Mike Greiling
Francisco Javier López
Grzegorz Bizon
Tieu-Philippe KHIM
Michael Kozono
Douwe Maan
Jacopo
Phil Hughes
Bryce Johnson
Robert Speicher
Rémy Coutable
Clement Ho
Long Nguyen
Felipe Artur
Douwe Maan
Robert Speicher
Alfredo Sumaran
Josh Frye
James Lopez
Valery Sizov