delta/gitlab/gitlab-ce.git/app/finders, branch chatops-deploy-command

Limit labels returned for a specific project as an administrator

2016-11-16T13:04:51+00:00

Prior, an administrator viewing a project's Labels page would see _all_
labels from every project they had access to, rather than only the
labels of that specific project (if any).

This was not an information disclosure, as admins have access to
everything, but it was a performance issue.

Merge branch '22481-honour-issue-visibility-for-groups' into 'security'

2016-11-09T11:24:13+00:00


Honour issue and merge request visibility in their respective finders

This MR fixes a security issue with the IssuesFinder and MergeRequestFinder where they would return items the user did not have permission to see. This was most visible on the issue and merge requests page for a group containing projects that had set their issues or merge requests to "private".

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/22481

See merge request !2000

Skip authorization check when searching for labels on IssuableFinder

2016-11-01T01:27:49+00:00

Use label subject to calculate number of issues/mrs within the group

2016-11-01T01:27:49+00:00

Pass user instance to Labels::FindOrCreateService or skip_authorization: true

2016-10-28T09:31:45+00:00

Do not pass project.owner because it may return a group and Labels::FindOrCreateService
throws an error in this case.
Fixes #23694.

Merge branch 'sh-optimize-label-finder' into 'master'

2016-10-25T15:55:59+00:00


Reduce overhead of LabelFinder by avoiding #presence call

Some users experienced 502 timeouts when viewing group labels.
Labels#open_issues_count and Label#open_merge_requests_count were
taking a long time to load because they were loading every ActiveRecord
of the user-accessible projects into memory. This change modifies so
that only the IDs are loaded into memory.

Closes #23684

See merge request !7094

Reduce overhead of LabelFinder by avoiding #presence call

2016-10-25T13:52:44+00:00

Some users experienced 502 timeouts when viewing group labels.
Labels#open_issues_count and Label#open_merge_requests_count were
taking a long time to load because they were loading every ActiveRecord
of the user-accessible projects into memory. This change modifies the system
so that #presence and hence to_a isn't called.

Closes #23684

Improve readability and add specs for label filtering

2016-10-25T06:06:14+00:00

Improve label filtering implementation

2016-10-25T05:40:09+00:00

Allow the use of params[:name] when filtering labels

2016-10-25T05:40:09+00:00