1. 06 7月, 2016 3 次提交
  2. 01 7月, 2016 1 次提交
  3. 30 6月, 2016 4 次提交
  4. 29 6月, 2016 6 次提交
  5. 28 6月, 2016 2 次提交
  6. 24 6月, 2016 1 次提交
    • R
      Fix an information disclosure when requesting access to a group containing private projects · aec3475d
      Rémy Coutable 提交于
      The issue was with the `User#groups` and `User#projects` associations
      which goes through the `User#group_members` and `User#project_members`.
      
      Initially I chose to use a secure approach by storing the requester's
      user ID in `Member#created_by_id` instead of `Member#user_id` because I
      was aware that there was a security risk since I didn't know the
      codebase well enough.
      
      Then during the review, we decided to change that and directly store the
      requester's user ID into `Member#user_id` (for the sake of simplifying
      the code I believe), meaning that every `group_members` / `project_members`
      association would include the requesters by default...
      
      My bad for not checking that all the `group_members` / `project_members`
      associations and the ones that go through them (e.g. `Group#users` and
      `Project#users`) were made safe with the `where(requested_at: nil)` /
      `where(members: { requested_at: nil })` scopes.
      
      Now they are all secure.
      Signed-off-by: NRémy Coutable <remy@rymai.me>
      aec3475d
  7. 20 6月, 2016 4 次提交
  8. 17 6月, 2016 2 次提交
  9. 16 6月, 2016 2 次提交
  10. 15 6月, 2016 5 次提交
  11. 14 6月, 2016 1 次提交
  12. 09 6月, 2016 1 次提交
    • S
      Allow custom text on 'almost there' page · 40b6d906
      Sean McGivern 提交于
      Add a new application setting, after_sign_up_text. This is text to be
      rendered as Markdown and shown on the 'almost there' page after a user
      signs up, but before they've confirmed their account.
      
      Tweak the styles for that page so that centered lists look reasonable.
      40b6d906
  13. 06 6月, 2016 1 次提交
  14. 03 6月, 2016 2 次提交
  15. 31 5月, 2016 1 次提交
  16. 26 5月, 2016 1 次提交
  17. 25 5月, 2016 1 次提交
  18. 20 5月, 2016 1 次提交
  19. 17 5月, 2016 1 次提交