[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Patch Kramdown syntax highlighter gem

See merge request gitlab-org/security/gitlab!1292

This restricts Rouge formatters to the Rouge::Formatters namespace to
prevent arbitrary classes from being instantiated.

Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/324452

[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Workhorse: prevent escaped router path traversal

See merge request gitlab-org/security/gitlab!1266

Possible XSS in wiki author name

See merge request gitlab-org/security/gitlab!1251

Clean up active session file

See merge request gitlab-org/security/gitlab!1270

Bump swagger-ui-dist version

See merge request gitlab-org/security/gitlab!1277

Bump thrift to 0.14.0

See merge request gitlab-org/security/gitlab!1273

Allow only group owners to manage group variables

See merge request gitlab-org/security/gitlab!1257

[ci skip]

Stop logging when path is excluded

See merge request gitlab-org/security/gitlab-workhorse!32

This causes logging a lot and reporting to sentry which can
cause performance issues.

Jacques Erasmus authored 4 years ago and Paul Slaughter committed 4 years ago

Bumped the swagger-ui-dist version to the latest

Fix date dependent spec with useFakeDate

See merge request gitlab-org/gitlab!55515

- Blocking other 13.8 backports

This is a minor bump of the thrift gem. This is a dependency of labkit
through jaeger-client

From to-do items

Remove binding.pry

Fix warden to-do

Add warden guard clause

Add changelog entry

Change naming in changelog

[ci skip]

Use URL.EscapePath() in upstream router (8-59-stable)

See merge request gitlab-org/security/gitlab-workhorse!27

Before this change we were allowing maintainers to manage
group variables even though our permissions page list only owners.

In this commit we fix a XSS when rendering the wiki
commit info in the header.

[merge-train skip]

[ci skip]

[ci skip]