GitLab

Created by: anon5r

I can create projects, teams, groups by some system reserved name on URL. And, the user access it, then the page returns the status 500 or 404, or system reserved page.

I tested creating it following case: projects

• public
  • Project "public" is show the public repository page.
• assets
  • Can access normal project page, but subsequent pages only returns the text of javascript.
• u
  • Can access normal project page, but subsequent pages were returned status 404.
• teams
  • This page was returned status 500.
• merge_requests
  • When the project created on any namespace returned 404.
  • When the project created on the group of "dashboard" is show the merge request page.

groups

• assets
  • Create project of any name and access this, system returns status 500.
• teams
  • Create project name by the name of existing team and access this, the URL was shown existing team page.

...and some other case exists may be.