1. 08 8月, 2017 1 次提交
  2. 03 3月, 2017 2 次提交
  3. 01 3月, 2017 1 次提交
  4. 01 2月, 2017 8 次提交
  5. 12 12月, 2016 1 次提交
  6. 08 8月, 2016 1 次提交
  7. 13 7月, 2016 1 次提交
    • J
      Defend against 'Host' header injection · 47b5b441
      Jacob Vosmaer 提交于
      Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/17877 .
      
      This change adds 'defense in depth' against 'Host' HTTP header
      injection. It affects normal users in the following way. Suppose your
      GitLab server has IP address 1.2.3.4 and hostname gitlab.example.com.
      Currently, if you enter 1.2.3.4 in your browser, you get redirected to
      1.2.3.4/users/sign_in. After this change, you get redirected from
      1.2.3.4 to gitlab.example.com/users/sign_in. This is because the
      address you typed in the address bar of your browser ('1.2.3.4'),
      which gets stored in the 'Host' header, is now being overwritten to
      'gitlab.example.com' in NGINX.
      
      In this change we also make NGINX clear the 'X-Forwarded-Host' header
      because Ruby on Rails also uses that header the same wayas the 'Host'
      header.
      
      We think that for most GitLab servers this is the right behavior, and
      if not then administrators can change this behavior themselves at the
      NGINX level.
      47b5b441
  8. 03 6月, 2016 2 次提交
  9. 23 5月, 2016 2 次提交
  10. 23 4月, 2016 1 次提交
  11. 15 4月, 2016 1 次提交
  12. 11 3月, 2016 1 次提交
  13. 11 12月, 2015 1 次提交
  14. 06 12月, 2015 1 次提交
  15. 28 11月, 2015 1 次提交
  16. 27 11月, 2015 2 次提交
  17. 19 11月, 2015 1 次提交
  18. 18 11月, 2015 1 次提交
  19. 16 11月, 2015 1 次提交
  20. 10 11月, 2015 2 次提交
  21. 29 10月, 2015 1 次提交
  22. 14 10月, 2015 1 次提交
  23. 08 10月, 2015 1 次提交
  24. 22 9月, 2015 1 次提交
  25. 17 9月, 2015 1 次提交
  26. 16 9月, 2015 1 次提交
  27. 07 9月, 2015 2 次提交
    • J
      The good stuff needs NGINX 1.7.11 · 783791fd
      Jacob Vosmaer 提交于
      783791fd
    • J
      Do not let NGINX buffer Git HTTP requests · 8d59b1ac
      Jacob Vosmaer 提交于
      Before this change NGINX would convert a chunked HTTP POST (e.g.
      git push) into a HTTP 1.0 single large POST. This creates an
      unnecessary delay, and it creates unnecessary memory pressure on
      gitlab-git-http-server.
      
      For the response ('proxy_buffering') I am less sure that NGINX 's
      buffering behavior is harmful, but it still makes more sense to me
      not to interfere with gitlab-git-http-server (and the Golang net/http
      server).
      8d59b1ac