1. 27 7月, 2018 3 次提交
  2. 25 7月, 2018 1 次提交
  3. 10 5月, 2018 2 次提交
    • B
      Allows `access_(git|api)` to anonymous users · d801dd17
      Bob Van Landuyt 提交于
      The `access_git` and `access_api` were currently never checked for
      anonymous users. And they would also be allowed access:
      
        An anonymous user can clone and pull from a public repo
      
        An anonymous user can request public information from the API
      
      So the policy didn't actually reflect what we were enforcing.
      d801dd17
    • B
      Block access to API & git when terms are enforced · f7f13f9d
      Bob Van Landuyt 提交于
      When terms are enforced, but the user has not accepted the terms
      access to the API & git is rejected with a message directing the user
      to the web app to accept the terms.
      f7f13f9d
  4. 29 9月, 2017 2 次提交
  5. 01 8月, 2017 1 次提交
  6. 25 7月, 2017 1 次提交
  7. 03 7月, 2017 1 次提交
  8. 30 6月, 2017 1 次提交
    • T
      Implement review comments for !12445 from @godfat and @rymai. · 3c88a786
      Timothy Andrew 提交于
      - Use `GlobalPolicy` to authorize the users that a non-authenticated user can
        fetch from `/api/v4/users`. We allow access if the `Gitlab::VisibilityLevel::PUBLIC`
        visibility level is not restricted.
      
      - Further, as before, `/api/v4/users` is only accessible to unauthenticated users if
        the `username` parameter is passed.
      
      - Turn off `authenticate!` for the `/api/v4/users` endpoint by matching on the actual
        route + method, rather than the description.
      
      - Change the type of `current_user` check in `UsersFinder` to be more
        compatible with EE.
      3c88a786
  9. 28 6月, 2017 1 次提交
  10. 15 6月, 2017 1 次提交
  11. 07 4月, 2017 1 次提交
  12. 10 3月, 2017 3 次提交
  13. 31 8月, 2016 2 次提交