delta/gitlab/gitlab-ce.git/app/controllers, branch api-docs-fix

Merge branch '24880-configurable-plaintext-emails' into 'master'

2016-11-29T12:05:23+00:00


Add setting to enable/disable HTML emails

Closes #24880

See merge request !7749

Merge branch 'jej-fix-missing-access-check-on-issues' into 'security'

2016-11-29T00:25:46+00:00

Fix missing access checks on issue lookup using IssuableFinder

Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867

:warning: - Potentially untested
:bomb: - No test coverage
:traffic_light: - Test coverage of some sort exists (a test failed when error raised)
:vertical_traffic_light: - Test coverage of return value (a test failed when nil used)
:white_check_mark: - Permissions check tested

- [x] :white_check_mark: app/controllers/projects/branches_controller.rb:39
  - `before_action :authorize_push_code!` helpes limit/prevent exploitation. Always checks for reporter access so fine with
    confidential issues, issues only visible to team, etc.
- [x] :traffic_light: app/models/cycle_analytics/summary.rb:9 [`.count`]
- [x] :white_check_mark: app/controllers/projects/todos_controller.rb:19

- [x] Potential double render in app/controllers/projects/todos_controller.rb

- https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#cedccb227af9bfdf88802767cb58d43c2b977439_24_24

See merge request !2030

Merge branch 'jej-22869' into 'security'

2016-11-29T00:25:18+00:00

Fix information disclosure in `Projects::BlobController#update`

It was possible to discover private project names by modifying `from_merge_request`parameter in `Projects::BlobController#update`. This fixes that.

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.md) entry added
- Tests
  - [x] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

https://gitlab.com/gitlab-org/gitlab-ce/issues/22869

See merge request !2023

Add new configuration setting to enable/disable HTML emails.

2016-11-28T22:00:03+00:00

This new global setting will allow admins to specify if HTML emails should be sent or not,
this is basically useful when system administrators want to save some disk space by avoiding
emails in HTML format and using only the Plain Text version.

Merge branch '25026-authenticate-user-for-new-snippet' into 'master'

2016-11-28T20:14:12+00:00


Ensure user is authenticated to create a new snippet

Closes #25026

See merge request !7786

Ensure user is authenticated to create a new snippet

2016-11-28T15:57:49+00:00

Signed-off-by: Rémy Coutable

Prevent error when submitting a merge request and pipeline is not defined

2016-11-28T11:03:59+00:00

Merge branch 'fix-dead-help-link' into 'master'

2016-11-28T09:01:08+00:00


Fix a broken link and avoid potential creation of future broken links on the help page.

See merge request !7582

Merge branch '22253-move-lfshelper-methods-somewhere-else-than-app-helpers' into 'master'

2016-11-28T05:33:35+00:00


This moves methods from `LfsHelper` to a new `LfsRequest` concern and
introduces a new `WorkhorseRequest` concern.

Closes #22253

See merge request !7623

Merge branch 'events-cache-invalidation' into 'master'

2016-11-28T03:34:12+00:00


Remove caching of events data

This MR removes the caching of events data as this was deemed unnecessary while increasing load on the database. See https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/6578#note_18864037 and 5371da341e9d7768ebab8e159b3e2cc8fad1d827 for more information.

See merge request !6578