1. 26 5月, 2020 1 次提交
  2. 15 4月, 2020 1 次提交
  3. 06 4月, 2020 1 次提交
  4. 01 4月, 2020 1 次提交
  5. 27 3月, 2020 1 次提交
  6. 23 3月, 2020 1 次提交
  7. 19 3月, 2020 1 次提交
  8. 14 3月, 2020 1 次提交
  9. 03 3月, 2020 1 次提交
  10. 25 2月, 2020 1 次提交
  11. 19 2月, 2020 1 次提交
  12. 11 2月, 2020 1 次提交
  13. 31 1月, 2020 1 次提交
  14. 10 1月, 2020 1 次提交
  15. 20 12月, 2019 1 次提交
  16. 10 12月, 2019 1 次提交
  17. 25 11月, 2019 1 次提交
  18. 11 10月, 2019 1 次提交
  19. 02 10月, 2019 1 次提交
  20. 25 9月, 2019 1 次提交
  21. 01 9月, 2019 1 次提交
  22. 29 8月, 2019 1 次提交
  23. 23 8月, 2019 1 次提交
  24. 10 8月, 2019 1 次提交
  25. 25 4月, 2019 1 次提交
  26. 11 4月, 2019 1 次提交
  27. 10 4月, 2019 1 次提交
  28. 05 4月, 2019 1 次提交
  29. 02 4月, 2019 3 次提交
  30. 13 2月, 2019 1 次提交
  31. 06 2月, 2019 1 次提交
  32. 04 2月, 2019 1 次提交
  33. 31 1月, 2019 1 次提交
    • N
      Verify that LFS upload requests are genuine · 5b075413
      Nick Thomas 提交于
      LFS uploads are handled in concert by workhorse and rails. In normal
      use, workhorse:
      
      * Authorizes the request with rails (upload_authorize)
      * Handles the upload of the file to a tempfile - disk or object storage
      * Validates the file size and contents
      * Hands off to rails to complete the upload (upload_finalize)
      
      In `upload_finalize`, the LFS object is linked to the project. As LFS
      objects are deduplicated across all projects, it may already exist. If
      not, the temporary file is copied to the correct place, and will be
      used by all future LFS objects with the same OID.
      
      Workhorse uses the Content-Type of the request to decide to follow this
      routine, as the URLs are ambiguous. If the Content-Type is anything but
      "application/octet-stream", the request is proxied directly to rails,
      on the assumption that this is a normal file edit request. If it's an
      actual LFS request with a different content-type, however, it is routed
      to the Rails `upload_finalize` action, which treats it as an LFS upload
      just as it would a workhorse-modified request.
      
      The outcome is that users can upload LFS objects that don't match the
      declared size or OID. They can also create links to LFS objects they
      don't really own, allowing them to read the contents of files if they
      know just the size or OID.
      
      We can close this hole by requiring requests to `upload_finalize` to be
      sourced from Workhorse. The mechanism to do this already exists.
      5b075413
  34. 23 1月, 2019 2 次提交
    • N
      Verify that LFS upload requests are genuine · 87c5abfc
      Nick Thomas 提交于
      LFS uploads are handled in concert by workhorse and rails. In normal
      use, workhorse:
      
      * Authorizes the request with rails (upload_authorize)
      * Handles the upload of the file to a tempfile - disk or object storage
      * Validates the file size and contents
      * Hands off to rails to complete the upload (upload_finalize)
      
      In `upload_finalize`, the LFS object is linked to the project. As LFS
      objects are deduplicated across all projects, it may already exist. If
      not, the temporary file is copied to the correct place, and will be
      used by all future LFS objects with the same OID.
      
      Workhorse uses the Content-Type of the request to decide to follow this
      routine, as the URLs are ambiguous. If the Content-Type is anything but
      "application/octet-stream", the request is proxied directly to rails,
      on the assumption that this is a normal file edit request. If it's an
      actual LFS request with a different content-type, however, it is routed
      to the Rails `upload_finalize` action, which treats it as an LFS upload
      just as it would a workhorse-modified request.
      
      The outcome is that users can upload LFS objects that don't match the
      declared size or OID. They can also create links to LFS objects they
      don't really own, allowing them to read the contents of files if they
      know just the size or OID.
      
      We can close this hole by requiring requests to `upload_finalize` to be
      sourced from Workhorse. The mechanism to do this already exists.
      87c5abfc
    • A
      Upgrade gitlab-workhorse to 8.1.0 · 51322670
      Andrew Newdigate 提交于
      51322670
  35. 12 12月, 2018 1 次提交
  36. 11 12月, 2018 1 次提交
  37. 07 12月, 2018 1 次提交