[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Workhorse: prevent escaped router path traversal

See merge request gitlab-org/security/gitlab!1267

Clean up active session file

See merge request gitlab-org/security/gitlab!1271

mksionek authored 4 years ago and GitLab Release Tools Bot committed 4 years ago

From to-do items

Remove binding.pry

Fix warden to-do

Add warden guard clause

Add changelog entry

Change naming in changelog

Bump swagger-ui-dist version

See merge request gitlab-org/security/gitlab!1278

Bump thrift to 0.14.0

See merge request gitlab-org/security/gitlab!1274

Allow only group owners to manage group variables

See merge request gitlab-org/security/gitlab!1258

[ci skip]

Stop logging when path is excluded

See merge request gitlab-org/security/gitlab-workhorse!33

This causes logging a lot and reporting to sentry which can
cause performance issues.

Bumped the swagger-ui-dist version to the latest

This is a minor bump of the thrift gem. This is a dependency of labkit
through jaeger-client

[ci skip]

Use URL.EscapePath() in upstream router (8-58-stable)

See merge request gitlab-org/security/gitlab-workhorse!26

Before this change we were allowing maintainers to manage
group variables even though our permissions page list only owners.

[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Prevent Denial of Service Attack on gitlab-shell

See merge request gitlab-org/security/gitlab!1199

Merge branch 'security-respect-analytics-enabled-rule-for-project-level-analytics-features-13-7' into '13-7-stable-ee'

Respect analytics_enabled policy rule

See merge request gitlab-org/security/gitlab!1228

Always perform SSL verification for FortiTokenCloud Integration

See merge request gitlab-org/security/gitlab!1189

Prevent SSRF requests for Prometheus when secured by Google IAP

See merge request gitlab-org/security/gitlab!1234

Change authorization policy for /lint

See merge request gitlab-org/security/gitlab!1212

Security check user access on API mr read actions

See merge request gitlab-org/security/gitlab!1206

Prevent exposure of confidential issue titles in file browser

See merge request gitlab-org/security/gitlab!1222

Cancel alive jobs on project deletion [RUN ALL RSPEC] [RUN AS-IF-FOSS]

See merge request gitlab-org/security/gitlab!1246

Allison Browne authored 4 years ago and GitLab Release Tools Bot committed 4 years ago

To avoid using runner resources on deleted projects we
cancel all cancelable jobs as the first step in deletion

Geo-GL-ID should be passed in JWT token so it's protected properly

See merge request gitlab-org/security/gitlab!1217