From f3b6c552f6763e20bbccaa80e306d939d6cf602c Mon Sep 17 00:00:00 2001
From: Marc Siegfriedt <marc@techaccelerator.com>
Date: Mon, 21 Aug 2017 21:09:45 +0000
Subject: fix :file_path - add requirements:

---
 lib/api/files.rb | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

(limited to 'lib/api')

diff --git a/lib/api/files.rb b/lib/api/files.rb
index e2ac7142bc4..1598d3c00b8 100644
--- a/lib/api/files.rb
+++ b/lib/api/files.rb
@@ -1,5 +1,7 @@
 module API
   class Files < Grape::API
+    FILE_ENDPOINT_REQUIREMENTS = API::PROJECT_ENDPOINT_REQUIREMENTS.merge(file_path: API::NO_SLASH_URL_PART_REGEX)
+
     # Prevents returning plain/text responses for files with .txt extension
     after_validation { content_type "application/json" }
 
@@ -58,13 +60,13 @@ module API
     params do
       requires :id, type: String, desc: 'The project ID'
     end
-    resource :projects, requirements: { id: %r{[^/]+} } do
+    resource :projects, requirements: FILE_ENDPOINT_REQUIREMENTS do
       desc 'Get raw file contents from the repository'
       params do
         requires :file_path, type: String, desc: 'The url encoded path to the file. Ex. lib%2Fclass%2Erb'
         requires :ref, type: String, desc: 'The name of branch, tag commit'
       end
-      get ":id/repository/files/:file_path/raw" do
+      get ":id/repository/files/:file_path/raw", requirements: FILE_ENDPOINT_REQUIREMENTS do
         assign_file_vars!
 
         send_git_blob @repo, @blob
@@ -75,7 +77,7 @@ module API
         requires :file_path, type: String, desc: 'The url encoded path to the file. Ex. lib%2Fclass%2Erb'
         requires :ref, type: String, desc: 'The name of branch, tag or commit'
       end
-      get ":id/repository/files/:file_path", requirements: { file_path: /.+/ } do
+      get ":id/repository/files/:file_path", requirements: FILE_ENDPOINT_REQUIREMENTS do
         assign_file_vars!
 
         {
@@ -95,7 +97,7 @@ module API
       params do
         use :extended_file_params
       end
-      post ":id/repository/files/:file_path", requirements: { file_path: /.+/ } do
+      post ":id/repository/files/:file_path", requirements: FILE_ENDPOINT_REQUIREMENTS do
         authorize! :push_code, user_project
 
         file_params = declared_params(include_missing: false)
@@ -113,7 +115,7 @@ module API
       params do
         use :extended_file_params
       end
-      put ":id/repository/files/:file_path", requirements: { file_path: /.+/ } do
+      put ":id/repository/files/:file_path", requirements: FILE_ENDPOINT_REQUIREMENTS do
         authorize! :push_code, user_project
 
         file_params = declared_params(include_missing: false)
@@ -137,7 +139,7 @@ module API
       params do
         use :simple_file_params
       end
-      delete ":id/repository/files/:file_path", requirements: { file_path: /.+/ } do
+      delete ":id/repository/files/:file_path", requirements: FILE_ENDPOINT_REQUIREMENTS do
         authorize! :push_code, user_project
 
         file_params = declared_params(include_missing: false)
-- 
cgit v1.2.1


From 5883ce95efcc4cc04f949f9b4e66d73fbede94e2 Mon Sep 17 00:00:00 2001
From: Sean McGivern <sean@gitlab.com>
Date: Thu, 31 Aug 2017 10:47:03 +0100
Subject: `current_application_settings` belongs on `Gitlab::CurrentSettings`

The initializers including this were doing so at the top level, so every object
loaded after them had a `current_application_settings` method. However, if
someone had rack-attack enabled (which was loaded before these initializers), it
would try to load the API, and fail, because `Gitlab::CurrentSettings` didn't
have that method.

To fix this:

1. Don't include `Gitlab::CurrentSettings` at the top level. We do not need
   `Object.new.current_application_settings` to work.
2. Make `Gitlab::CurrentSettings` explicitly `extend self`, as we already use it
   like that in several places.
3. Change the initializers to use that new form.
---
 lib/api/helpers/runner.rb | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'lib/api')

diff --git a/lib/api/helpers/runner.rb b/lib/api/helpers/runner.rb
index f8645e364ce..282af32ca94 100644
--- a/lib/api/helpers/runner.rb
+++ b/lib/api/helpers/runner.rb
@@ -1,6 +1,8 @@
 module API
   module Helpers
     module Runner
+      include Gitlab::CurrentSettings
+
       JOB_TOKEN_HEADER = 'HTTP_JOB_TOKEN'.freeze
       JOB_TOKEN_PARAM = :token
       UPDATE_RUNNER_EVERY = 10 * 60
-- 
cgit v1.2.1