<feed xmlns='http://www.w3.org/2005/Atom'>
<title>delta/gitlab/gitlab-ce.git/spec, branch ctrl-enter-multiple-comments</title>
<subtitle>gitlab.com: gitlab-org/gitlab-ce.git
</subtitle>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/gitlab/gitlab-ce.git/'/>
<entry>
<title>Fix tests and unassigned filter for issues. Updated CHANGELOG</title>
<updated>2015-03-27T07:27:51+00:00</updated>
<author>
<name>Dmitriy Zaporozhets</name>
<email>dmitriy.zaporozhets@gmail.com</email>
</author>
<published>2015-03-27T07:27:51+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/gitlab/gitlab-ce.git/commit/?id=c1c93f4f7a51760660ea2e1994071e63e6793808'/>
<id>c1c93f4f7a51760660ea2e1994071e63e6793808</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Add autocomplete controller</title>
<updated>2015-03-27T02:06:19+00:00</updated>
<author>
<name>Dmitriy Zaporozhets</name>
<email>dmitriy.zaporozhets@gmail.com</email>
</author>
<published>2015-03-27T02:06:19+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/gitlab/gitlab-ce.git/commit/?id=26053c870530ebb6d276a364ea9d40d202ead0de'/>
<id>26053c870530ebb6d276a364ea9d40d202ead0de</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge pull request #9034 from buildkite/rename-buildbox-to-buildkite</title>
<updated>2015-03-26T15:54:48+00:00</updated>
<author>
<name>Dmitriy Zaporozhets</name>
<email>dmitriy.zaporozhets@gmail.com</email>
</author>
<published>2015-03-26T15:54:48+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/gitlab/gitlab-ce.git/commit/?id=a9cfff256ddd3688d95bb45f77b2222f5496d6af'/>
<id>a9cfff256ddd3688d95bb45f77b2222f5496d6af</id>
<content type='text'>
Renamed Buildbox to Buildkite.</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Renamed Buildbox to Buildkite.</pre>
</div>
</content>
</entry>
<entry>
<title>Renamed Buildbox to Buildkite.</title>
<updated>2015-03-26T11:40:43+00:00</updated>
<author>
<name>Keith Pitt</name>
<email>me@keithpitt.com</email>
</author>
<published>2015-03-26T11:40:43+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/gitlab/gitlab-ce.git/commit/?id=7fdc017650e053ace32b7937c104577db45bf513'/>
<id>7fdc017650e053ace32b7937c104577db45bf513</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge pull request #8007 from mr-vinn/markdown-tags</title>
<updated>2015-03-25T17:21:03+00:00</updated>
<author>
<name>Dmitriy Zaporozhets</name>
<email>dmitriy.zaporozhets@gmail.com</email>
</author>
<published>2015-03-25T17:21:03+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/gitlab/gitlab-ce.git/commit/?id=6199da0cb49d2e30071d2bbb08735ce2265c7aff'/>
<id>6199da0cb49d2e30071d2bbb08735ce2265c7aff</id>
<content type='text'>
Allow HTML tags in user Markdown input</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Allow HTML tags in user Markdown input</pre>
</div>
</content>
</entry>
<entry>
<title>Merge branch 'api-internal-errors' into 'master'</title>
<updated>2015-03-25T04:16:45+00:00</updated>
<author>
<name>Dmitriy Zaporozhets</name>
<email>dmitriy.zaporozhets@gmail.com</email>
</author>
<published>2015-03-25T04:16:45+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/gitlab/gitlab-ce.git/commit/?id=8f3f6e9efbbacf5e52f98324944f644630da2f18'/>
<id>8f3f6e9efbbacf5e52f98324944f644630da2f18</id>
<content type='text'>
Respond with full GitAccess error if user has project read access.

Should help with debugging #1236.

cc @marin

See merge request !437
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Respond with full GitAccess error if user has project read access.

Should help with debugging #1236.

cc @marin

See merge request !437
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge branch 'master' into markdown-tags</title>
<updated>2015-03-25T02:03:22+00:00</updated>
<author>
<name>Vinnie Okada</name>
<email>vokada@mrvinn.com</email>
</author>
<published>2015-03-25T02:03:22+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/gitlab/gitlab-ce.git/commit/?id=057c8c344b6518cb50b81607e0f88734fc164a9e'/>
<id>057c8c344b6518cb50b81607e0f88734fc164a9e</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge branch 'git-auth-rack-attack-improvements' into 'master'</title>
<updated>2015-03-24T21:51:40+00:00</updated>
<author>
<name>Dmitriy Zaporozhets</name>
<email>dmitriy.zaporozhets@gmail.com</email>
</author>
<published>2015-03-24T21:51:40+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/gitlab/gitlab-ce.git/commit/?id=fc4af9b1975827d4e5ead18dc3468d9aa29cd9ac'/>
<id>fc4af9b1975827d4e5ead18dc3468d9aa29cd9ac</id>
<content type='text'>
Reduce Rack Attack false positives causing 403 errors during HTTP authentication

### What does this MR do?

This MR reduces false positives causing `403 Forbidden` messages after HTTP authentication.

A Git client may attempt to access a repository without a password. If it receives a 401 error, the client often will try again, this time supplying a password. The problem is that `grack_auth.rb` considers a blank password an authentication failure and increases a Redis counter each time this happens. With enough requests, an IP can be banned temporarily even though previous attempts may have been successful. This leads users to see `403 Forbidden` errors until the ban times out (default: 1 hour).

To reduce the chance of a false positive, this MR resets the counter upon a successful authentication from an IP.

In addition, this MR logs when a user has been banned and introduces the ability to disable Rack Attack via a config variable.

### Are there points in the code the reviewer needs to double check?

rack-attack v4.2.0 doesn't support the ability to clear counters out of the box, so `rack_attack_helpers.rb` includes a number of monkey patches to make it work. It looks like this functionality may be added in v4.3.0. I've also sent pull requests to rack-attack to add the functionality necessary to delete a key.

Each time an authentication is successful, the Redis counter for that IP is cleared. I deemed it better to clear the counter than to allow for blank passwords, since the latter seems like a security risk.

### Why was this MR needed?

It was quite difficult to figure out why users were seeing `403 Forbidden`, which is why the log message was added. Users were getting a lot of false positives when accessing repositories with HTTPS. Including the username in the HTTPS URL (e.g. `https://username@mydomain.com/account/repo.git`) caused authentication failures because while the git client provided the username, it left the password blank, leading to an authentication failure.

### What are the relevant issue numbers / [Feature requests](http://feedback.gitlab.com/)?

See Issue #1171

https://github.com/kickstarter/rack-attack/issues/113

See merge request !392
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Reduce Rack Attack false positives causing 403 errors during HTTP authentication

### What does this MR do?

This MR reduces false positives causing `403 Forbidden` messages after HTTP authentication.

A Git client may attempt to access a repository without a password. If it receives a 401 error, the client often will try again, this time supplying a password. The problem is that `grack_auth.rb` considers a blank password an authentication failure and increases a Redis counter each time this happens. With enough requests, an IP can be banned temporarily even though previous attempts may have been successful. This leads users to see `403 Forbidden` errors until the ban times out (default: 1 hour).

To reduce the chance of a false positive, this MR resets the counter upon a successful authentication from an IP.

In addition, this MR logs when a user has been banned and introduces the ability to disable Rack Attack via a config variable.

### Are there points in the code the reviewer needs to double check?

rack-attack v4.2.0 doesn't support the ability to clear counters out of the box, so `rack_attack_helpers.rb` includes a number of monkey patches to make it work. It looks like this functionality may be added in v4.3.0. I've also sent pull requests to rack-attack to add the functionality necessary to delete a key.

Each time an authentication is successful, the Redis counter for that IP is cleared. I deemed it better to clear the counter than to allow for blank passwords, since the latter seems like a security risk.

### Why was this MR needed?

It was quite difficult to figure out why users were seeing `403 Forbidden`, which is why the log message was added. Users were getting a lot of false positives when accessing repositories with HTTPS. Including the username in the HTTPS URL (e.g. `https://username@mydomain.com/account/repo.git`) caused authentication failures because while the git client provided the username, it left the password blank, leading to an authentication failure.

### What are the relevant issue numbers / [Feature requests](http://feedback.gitlab.com/)?

See Issue #1171

https://github.com/kickstarter/rack-attack/issues/113

See merge request !392
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge branch 'fix-nested-tasks' into 'master'</title>
<updated>2015-03-24T20:57:35+00:00</updated>
<author>
<name>Dmitriy Zaporozhets</name>
<email>dmitriy.zaporozhets@gmail.com</email>
</author>
<published>2015-03-24T20:57:35+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/gitlab/gitlab-ce.git/commit/?id=b8ad3647ad99a64ffc6296883aa8135d462dd17b'/>
<id>b8ad3647ad99a64ffc6296883aa8135d462dd17b</id>
<content type='text'>
Fix nested task lists

When nesting task list items, the parent item is wrapped in a `&lt;p&gt;` tag.  Update the task list parser to handle these paragraph wrappers.

cc @sytse

See merge request !413
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Fix nested task lists

When nesting task list items, the parent item is wrapped in a `&lt;p&gt;` tag.  Update the task list parser to handle these paragraph wrappers.

cc @sytse

See merge request !413
</pre>
</div>
</content>
</entry>
<entry>
<title>Refactor GitAccess to use instance variables.</title>
<updated>2015-03-24T13:11:48+00:00</updated>
<author>
<name>Douwe Maan</name>
<email>douwe@gitlab.com</email>
</author>
<published>2015-03-24T13:10:55+00:00</published>
<link rel='alternate' type='text/html' href='http://91.123.203.49/cgit/delta/gitlab/gitlab-ce.git/commit/?id=4830b2be5e076126f89d2c67bab94302559aa93a'/>
<id>4830b2be5e076126f89d2c67bab94302559aa93a</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
</feed>
