[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Workhorse: prevent escaped router path traversal

See merge request gitlab-org/security/gitlab!1266

Possible XSS in wiki author name

See merge request gitlab-org/security/gitlab!1251

Clean up active session file

See merge request gitlab-org/security/gitlab!1270

Bump swagger-ui-dist version

See merge request gitlab-org/security/gitlab!1277

Bump thrift to 0.14.0

See merge request gitlab-org/security/gitlab!1273

Allow only group owners to manage group variables

See merge request gitlab-org/security/gitlab!1257

[ci skip]

Stop logging when path is excluded

See merge request gitlab-org/security/gitlab-workhorse!32

This causes logging a lot and reporting to sentry which can
cause performance issues.

Jacques Erasmus authored 4 years ago and Paul Slaughter committed 4 years ago

Bumped the swagger-ui-dist version to the latest

Fix date dependent spec with useFakeDate

See merge request gitlab-org/gitlab!55515

- Blocking other 13.8 backports

This is a minor bump of the thrift gem. This is a dependency of labkit
through jaeger-client

From to-do items

Remove binding.pry

Fix warden to-do

Add warden guard clause

Add changelog entry

Change naming in changelog

[ci skip]

Use URL.EscapePath() in upstream router (8-59-stable)

See merge request gitlab-org/security/gitlab-workhorse!27

Before this change we were allowing maintainers to manage
group variables even though our permissions page list only owners.

In this commit we fix a XSS when rendering the wiki
commit info in the header.

[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Prevent Denial of Service Attack on gitlab-shell

See merge request gitlab-org/security/gitlab!1198

Merge branch 'security-respect-analytics-enabled-rule-for-project-level-analytics-features-13-8' into '13-8-stable-ee'

Respect analytics_enabled policy rule

See merge request gitlab-org/security/gitlab!1227

Always perform SSL verification for FortiTokenCloud Integration

See merge request gitlab-org/security/gitlab!1188

Prevent SSRF requests for Prometheus when secured by Google IAP

See merge request gitlab-org/security/gitlab!1233

Change authorization policy for /lint

See merge request gitlab-org/security/gitlab!1211

Security check user access on API mr read actions

See merge request gitlab-org/security/gitlab!1205