{"push_id":1426935363,"size":8,"distinct_size":0,"ref":"refs/heads/8-13-stable","head":"2faf3279b4cf2e3a2bcd9697dae6ef272690c373","before":"4ed4b1b907cade8108c3c0da35981ff81dc1096a","commits":[{"sha":"b73edc5e171d50d86135ebb9e89b5eb46a232279","author":{"name":"Douwe Maan","email":"44d6053499df8727d9880ee47f49443fcdf7760f@gitlab.com"},"message":"Merge branch '23990-project-show-error-when-empty-repo' into 'master'\r\n\r\n500 error on project show when user is not logged in and project is still empty\r\n\r\n## What does this MR do?\r\n\r\nAims to fix the 500 error when the project is empty and the user is not logged in and tries to access project#show\r\n\r\n## Screenshots (if relevant)\r\nWhen the project is empty and the user is not logged in we default to the empty project partial instead of readme.\r\n\r\n![Screen_Shot_2016-11-11_at_22.54.21](/uploads/3d87e65195376c85d3e515e6d5a9a850/Screen_Shot_2016-11-11_at_22.54.21.png)\r\n\r\n## Does this MR meet the acceptance criteria?\r\n\r\n- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added\r\n- [x] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)\r\n- [x] API support added\r\n- Tests\r\n  - [x] Added for this feature/bug\r\n  - [x] All builds are passing\r\n- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)\r\n- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)\r\n- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)\r\n- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)\r\n\r\n## What are the relevant issue numbers?\r\n\r\nCloses #23990\r\n\r\nSee merge request !7376","distinct":false,"url":"https://api.github.com/repos/dreampet/gitlab/commits/b73edc5e171d50d86135ebb9e89b5eb46a232279"},{"sha":"cf262a102f4c8255b0c947cf1c704c34557035c9","author":{"name":"Douwe Maan","email":"44d6053499df8727d9880ee47f49443fcdf7760f@gitlab.com"},"message":"Merge branch 'zj-fix-label-creation-non-members' into 'security'\r\n\r\nFix label creation non members\r\n\r\nFixes https://gitlab.com/gitlab-org/gitlab-ce/issues/23416\r\n\r\nSee merge request !2006","distinct":false,"url":"https://api.github.com/repos/dreampet/gitlab/commits/cf262a102f4c8255b0c947cf1c704c34557035c9"},{"sha":"859498b7d3e81a04205f77382e7b764ab6c0cc4f","author":{"name":"Douwe Maan","email":"44d6053499df8727d9880ee47f49443fcdf7760f@gitlab.com"},"message":"Merge branch 'jej-22869' into 'security'\n\nFix information disclosure in `Projects::BlobController#update`\n\n## What does this MR do?\n\nIt was possible to discover private project names by modifying `from_merge_request`parameter in `Projects::BlobController#update`. This fixes that.\n\n## Does this MR meet the acceptance criteria?\n\n- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.md) entry added\n- Tests\n  - [x] Added for this feature/bug\n  - [ ] All builds are passing\n- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)\n- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)\n- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)\n\n## What are the relevant issue numbers?\n\nhttps://gitlab.com/gitlab-org/gitlab-ce/issues/22869\n\nSee merge request !2023\n\nSigned-off-by: Rémy Coutable <remy@rymai.me>","distinct":false,"url":"https://api.github.com/repos/dreampet/gitlab/commits/859498b7d3e81a04205f77382e7b764ab6c0cc4f"},{"sha":"5fe4df90c2847d0d4eb31d925465bcec633c2b93","author":{"name":"Douwe Maan","email":"44d6053499df8727d9880ee47f49443fcdf7760f@gitlab.com"},"message":"Merge branch 'jej-fix-missing-access-check-on-issues' into 'security'\r\n\r\nFix missing access checks on issue lookup using IssuableFinder\r\n\r\nSplit from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867\r\n\r\n## Which fixes are in this MR?\r\n\r\n:warning: - Potentially untested  \r\n:bomb: - No test coverage  \r\n:traffic_light: - Test coverage of some sort exists (a test failed when error raised)  \r\n:vertical_traffic_light: - Test coverage of return value (a test failed when nil used)  \r\n:white_check_mark: - Permissions check tested\r\n\r\n### Issue lookup without access check (security)\r\n\r\n- [x] :white_check_mark: app/controllers/projects/branches_controller.rb:39\r\n  - `before_action :authorize_push_code!` helpes limit/prevent exploitation. Always checks for reporter access so fine with\r\n    confidential issues, issues only visible to team, etc.\r\n- [x] :traffic_light: app/models/cycle_analytics/summary.rb:9 [`.count`] \r\n- [x] :white_check_mark: app/controllers/projects/todos_controller.rb:19\r\n\r\n### Code smells\r\n- [x] Potential double render in app/controllers/projects/todos_controller.rb\r\n\r\n### Previous discussions\r\n- https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#cedccb227af9bfdf88802767cb58d43c2b977439_24_24\r\n\r\nSee merge request !2030","distinct":false,"url":"https://api.github.com/repos/dreampet/gitlab/commits/5fe4df90c2847d0d4eb31d925465bcec633c2b93"},{"sha":"e78182a5faff7ed1cea59dea901ff8602b8ad638","author":{"name":"Douwe Maan","email":"44d6053499df8727d9880ee47f49443fcdf7760f@gitlab.com"},"message":"Merge branch 'jej-use-issuable-finder-instead-of-access-check' into 'security'\n\nReplace issue access checks with use of IssuableFinder\n\nSplit from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867\n\n:warning: - Potentially untested\n:bomb: - No test coverage\n:traffic_light: - Test coverage of some sort exists (a test failed when error raised)\n:vertical_traffic_light: - Test coverage of return value (a test failed when nil used)\n:white_check_mark: - Permissions check tested\n\nUsing `visible_to_user` likely makes these security issues too. See [Code smells](#code-smells).\n\n- [x] :vertical_traffic_light: app/finders/notes_finder.rb:15 [`visible_to_user`]\n- [x] :traffic_light: app/views/layouts/nav/_project.html.haml:73 [`visible_to_user`] [`.count`]\n- [x] :white_check_mark: app/services/merge_requests/build_service.rb:84 [`issue.try(:confidential?)`]\n- [x] :white_check_mark: lib/api/issues.rb:112 [`visible_to_user`]\n  - CHANGELOG: Prevented API returning issues set to 'Only team members' to everyone\n- [x] :white_check_mark: lib/api/helpers.rb:126 [`can?(current_user, :read_issue, issue)`] Maybe here too?\n- [x] :white_check_mark: lib/gitlab/search_results.rb:53 [`visible_to_user`]\n\n- [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b2ff264eddf9819d7693c14ae213d941494fe2b3_128_126\n- [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#7b6375270d22f880bdcb085e47b519b426a5c6c7_87_87\n\nSee merge request !2031\n\nSigned-off-by: Rémy Coutable <remy@rymai.me>","distinct":false,"url":"https://api.github.com/repos/dreampet/gitlab/commits/e78182a5faff7ed1cea59dea901ff8602b8ad638"},{"sha":"b382a21bf54ee91dd796963b112493f469155959","author":{"name":"Robert Speicher","email":"b93e48b8445e5b838ee3472c32911ea601bd3bb0@gitlab.com"},"message":"Merge branch 'zj-upgrade-grape' into 'master'\n\nUpdate grape-entity to 0.6.0\n\nSee merge request !7491\n\nSigned-off-by: Rémy Coutable <remy@rymai.me>","distinct":false,"url":"https://api.github.com/repos/dreampet/gitlab/commits/b382a21bf54ee91dd796963b112493f469155959"},{"sha":"3c67222e700123477e6cb01ffbe4fc922e97ae38","author":{"name":"Rémy Coutable","email":"12b949333843de6e6f21a7e87fa579d682a8e382@rymai.me"},"message":"Update CHANGELOG.md for 8.13.7\n\n[ci skip]","distinct":false,"url":"https://api.github.com/repos/dreampet/gitlab/commits/3c67222e700123477e6cb01ffbe4fc922e97ae38"},{"sha":"2faf3279b4cf2e3a2bcd9697dae6ef272690c373","author":{"name":"Rémy Coutable","email":"12b949333843de6e6f21a7e87fa579d682a8e382@rymai.me"},"message":"Update VERSION to 8.13.7","distinct":false,"url":"https://api.github.com/repos/dreampet/gitlab/commits/2faf3279b4cf2e3a2bcd9697dae6ef272690c373"}]}
{"actor":{"display_login":"dreampet"}}