| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
| |
Filter all possibly class values on code tags in Textile.
Contributed by Holger Just from Planio.
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@19336 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@18433 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@18130 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@17768 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@17654 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@17650 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@17637 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@17604 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@17451 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@17323 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@17267 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@17247 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@17159 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
|
|
|
|
|
|
|
| |
mercurial: work around faulty parsing of early command options
Use -sVALUE and --long=VALUE instead of "-s VALUE" and "--long VALUE"
respectively.
Contributed by Yuya Nishihara.
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@17068 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
mercurial: reject malicious command argument
We've got a security report from the Phabricator team, which basically says
--config and --debugger arguments can be injected anywhere to lead to an
arbitrary command execution.
https://secure.phabricator.com/rPa7921a4448093d00defa8bd18f35b8c8f8bf3314
This is a fundamental issue of the argument parsing rules in Mercurial, which
allows extensions to populate their parsing rules and such extensions can be
loaded by "--config extensions.<name>=". There's a chicken and egg problem.
We're working on hardening the parsing rules, but which won't come in by
default as it would be a behavior change.
This patch adds a verification to reject malicious command arguments as a
last ditch. The subsequent patches will fix the problem in more appropriate
way.
Contributed by Yuya Nishihara.
git-svn-id: http://svn.redmine.org/redmine/branches/3.4-stable@17066 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@16685 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
|
|
|
|
| |
(#26055).
Patch by Mischa The Evil.
git-svn-id: http://svn.redmine.org/redmine/trunk@16625 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
|
|
|
|
|
| |
* Disallow setting arbitrary classes and ids via Textile syntax
* Only allow valid/supported languages for syntax highlighted code blocks
Patch by Jan Schulz-Hofen.
git-svn-id: http://svn.redmine.org/redmine/trunk@16502 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
|
|
| |
Patch by Jan Schulz-Hofen.
git-svn-id: http://svn.redmine.org/redmine/trunk@16500 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@16445 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@16380 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@16359 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@16273 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@16271 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@16194 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@16173 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@16072 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@16064 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@16060 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@15992 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@15974 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@15917 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@15846 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@15686 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@15680 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@15607 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@15539 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
|
|
|
|
| |
fields (#23083).
Patch by Holger Just.
git-svn-id: http://svn.redmine.org/redmine/trunk@15536 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
|
|
|
|
| |
They are characterized by having a blank url. they will only be rendered if the user is authorized to see at least one of its children. they render as links which do nothing when clicked.
Patch by Jan Schulz-Hofen.
git-svn-id: http://svn.redmine.org/redmine/trunk@15501 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@15435 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
|
|
|
|
| |
EnumerationFormat#value_from_keyword (#22911).
Patch by Haihan Ji.
git-svn-id: http://svn.redmine.org/redmine/trunk@15429 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
|
|
|
|
| |
see them (#15880).
Patch by Jan Schulz-Hofen.
git-svn-id: http://svn.redmine.org/redmine/trunk@15393 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
|
|
| |
Objects are reordered using the regular attribute writer #position= and AR callbacks.
git-svn-id: http://svn.redmine.org/redmine/trunk@15335 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
|
|
| |
Patch by Felix Schäfer.
git-svn-id: http://svn.redmine.org/redmine/trunk@15287 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@15238 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@15187 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@14867 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@14863 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@14812 e93f8b46-1217-0410-a6f0-8f06a7374b81
|
|
|
|
| |
git-svn-id: http://svn.redmine.org/redmine/trunk@14766 e93f8b46-1217-0410-a6f0-8f06a7374b81
|