diff options
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/api/groups.md | 4 | ||||
| -rw-r--r-- | doc/ci/yaml/README.md | 2 | ||||
| -rw-r--r-- | doc/topics/autodevops/index.md | 33 | ||||
| -rw-r--r-- | doc/user/application_security/dependency_list/index.md | 2 | ||||
| -rw-r--r-- | doc/user/application_security/sast/index.md | 6 | ||||
| -rw-r--r-- | doc/user/profile/preferences.md | 9 | ||||
| -rw-r--r-- | doc/user/project/operations/error_tracking.md | 2 |
7 files changed, 53 insertions, 5 deletions
diff --git a/doc/api/groups.md b/doc/api/groups.md index ea2493111df..25a61632bd3 100644 --- a/doc/api/groups.md +++ b/doc/api/groups.md @@ -487,7 +487,7 @@ Parameters: | `two_factor_grace_period` | integer | no | Time before Two-factor authentication is enforced (in hours). | | `project_creation_level` | string | no | Determine if developers can create projects in the group. Can be `noone` (No one), `maintainer` (Maintainers), or `developer` (Developers + Maintainers). | | `auto_devops_enabled` | boolean | no | Default to Auto DevOps pipeline for all projects within this group. | -| `subgroup_creation_level` | integer | no | Allowed to create subgroups. Can be `owner` (Owners), or `maintainer` (Maintainers). | +| `subgroup_creation_level` | string | no | Allowed to create subgroups. Can be `owner` (Owners), or `maintainer` (Maintainers). | | `emails_disabled` | boolean | no | Disable email notifications | | `mentions_disabled` | boolean | no | Disable the capability of a group from getting mentioned | | `lfs_enabled` | boolean | no | Enable/disable Large File Storage (LFS) for the projects in this group. | @@ -533,7 +533,7 @@ PUT /groups/:id | `two_factor_grace_period` | integer | no | Time before Two-factor authentication is enforced (in hours). | | `project_creation_level` | string | no | Determine if developers can create projects in the group. Can be `noone` (No one), `maintainer` (Maintainers), or `developer` (Developers + Maintainers). | | `auto_devops_enabled` | boolean | no | Default to Auto DevOps pipeline for all projects within this group. | -| `subgroup_creation_level` | integer | no | Allowed to create subgroups. Can be `owner` (Owners), or `maintainer` (Maintainers). | +| `subgroup_creation_level` | string | no | Allowed to create subgroups. Can be `owner` (Owners), or `maintainer` (Maintainers). | | `emails_disabled` | boolean | no | Disable email notifications | | `mentions_disabled` | boolean | no | Disable the capability of a group from getting mentioned | | `lfs_enabled` (optional) | boolean | no | Enable/disable Large File Storage (LFS) for the projects in this group. | diff --git a/doc/ci/yaml/README.md b/doc/ci/yaml/README.md index 6b1a0e4ffe6..7e67ddc9021 100644 --- a/doc/ci/yaml/README.md +++ b/doc/ci/yaml/README.md @@ -1970,7 +1970,7 @@ job: > Introduced in GitLab 8.9 and GitLab Runner v1.3.0. `expire_in` allows you to specify how long artifacts should live before they -expire and therefore deleted, counting from the time they are uploaded and +expire and are therefore deleted, counting from the time they are uploaded and stored on GitLab. If the expiry time is not defined, it defaults to the [instance wide setting](../../user/admin_area/settings/continuous_integration.md#default-artifacts-expiration-core-only) (30 days by default, forever on GitLab.com). diff --git a/doc/topics/autodevops/index.md b/doc/topics/autodevops/index.md index 4268e386425..cc9ef3ab5c5 100644 --- a/doc/topics/autodevops/index.md +++ b/doc/topics/autodevops/index.md @@ -762,6 +762,39 @@ networkPolicy: app.gitlab.com/managed_by: gitlab ``` +#### Web Application Firewall (ModSecurity) customization + +> [Introduced](https://gitlab.com/gitlab-org/charts/auto-deploy-app/-/merge_requests/44) in GitLab 12.8. + +Customization on an [Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) or on a deployment base is available for clusters with [ModSecurity installed](../../user/clusters/applications.md#web-application-firewall-modsecurity). + +To enable ModSecurity with Auto Deploy, you need to create a `.gitlab/auto-deploy-values.yaml` file in your project with the following attributes. + +|Attribute | Description | Default | +-----------|-------------|---------| +|`enabled` | Enables custom configuration for modsecurity, defaulting to the [Core Rule Set](https://coreruleset.org/) | `false` | +|`secRuleEngine` | Configures the [rules engine](https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#secruleengine) | `DetectionOnly` | +|`secRules` | Creates one or more additional [rule](https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#SecRule) | `nil` | + +In the following `auto-deploy-values.yaml` example, some custom settings +are enabled for ModSecurity. Those include setting its engine to +process rules instead of only logging them, while adding two specific +rules which are header-based: + +```yaml +ingress: + modSecurity: + enabled: true + secRuleEngine: "On" + secRules: + - variable: "REQUEST_HEADERS:User-Agent" + operator: "printer" + action: "log,deny,id:'2010',status:403,msg:'printer is an invalid agent'" + - variable: "REQUEST_HEADERS:Content-Type" + operator: "text/plain" + action: "log,deny,id:'2011',status:403,msg:'Text is not supported as content type'" +``` + #### Running commands in the container Applications built with [Auto Build](#auto-build) using Herokuish, the default diff --git a/doc/user/application_security/dependency_list/index.md b/doc/user/application_security/dependency_list/index.md index 2828d487153..992f4137bb8 100644 --- a/doc/user/application_security/dependency_list/index.md +++ b/doc/user/application_security/dependency_list/index.md @@ -5,7 +5,7 @@ The Dependency list allows you to see your project's dependencies, and key details about them, including their known vulnerabilities. To see it, navigate to **Security & Compliance > Dependency List** in your project's -sidebar. +sidebar. This information is sometimes referred to as a Software Bill of Materials or SBoM / BOM. ## Requirements diff --git a/doc/user/application_security/sast/index.md b/doc/user/application_security/sast/index.md index ea9c0b85bea..fad6d33dc7f 100644 --- a/doc/user/application_security/sast/index.md +++ b/doc/user/application_security/sast/index.md @@ -454,6 +454,12 @@ CI/CD configuration file to turn it on. Results are available in the SAST report GitLab currently includes [Gitleaks](https://github.com/zricethezav/gitleaks) and [TruffleHog](https://github.com/dxa4481/truffleHog) checks. +NOTE: **Note:** +The secrets analyzer will ignore "Password in URL" vulnerabilities if the password begins +with a dollar sign (`$`) as this likely indicates the password being used is an environment +variable. For example, `https://username:$password@example.com/path/to/repo` will not be +detected, whereas `https://username:password@example.com/path/to/repo` would be detected. + ## Security Dashboard The Security Dashboard is a good place to get an overview of all the security diff --git a/doc/user/profile/preferences.md b/doc/user/profile/preferences.md index b299c74c8f4..cd195e6e7a1 100644 --- a/doc/user/profile/preferences.md +++ b/doc/user/profile/preferences.md @@ -108,6 +108,15 @@ You can choose between 3 options: - Readme - Activity +### Tab width + +You can set the displayed width of tab characters across various parts of +GitLab, for example, blobs, diffs, and snippets. + +NOTE: **Note:** +Some parts of GitLab do not respect this setting, including the WebIDE, file +editor and Markdown editor. + ## Localization ### Language diff --git a/doc/user/project/operations/error_tracking.md b/doc/user/project/operations/error_tracking.md index 685fdefe0c6..e87b5d03438 100644 --- a/doc/user/project/operations/error_tracking.md +++ b/doc/user/project/operations/error_tracking.md @@ -25,7 +25,7 @@ GitLab provides an easy way to connect Sentry to your project: Make sure to give the token at least the following scopes: `event:read` and `project:read`. 1. Navigate to your project’s **Settings > Operations**. 1. Ensure that the **Active** checkbox is set. -1. In the **Sentry API URL** field, enter your Sentry hostname. For example, `https://sentry.example.com`. +1. In the **Sentry API URL** field, enter your Sentry hostname. For example, enter `https://sentry.example.com` if this is the address at which your Sentry instance is available. For the SaaS version of Sentry, the hostname will be `https://sentry.io`. 1. In the **Auth Token** field, enter the token you previously generated. 1. Click the **Connect** button to test the connection to Sentry and populate the **Project** dropdown. 1. From the **Project** dropdown, choose a Sentry project to link to your GitLab project. |