[ci skip]

[ci skip]

Merge branch 'security-fj-add-snippet-repository-validation-bundle-import-13-0' into '13-0-stable-ee'

Lack of validations importing snippet repository from bundle

See merge request gitlab-org/security/gitlab!612

Do not show activity for users with private profiles

See merge request gitlab-org/security/gitlab!688

Check access when sending TODOs related to merge requests

See merge request gitlab-org/security/gitlab!673

Disable caching for wiki attachments

See merge request gitlab-org/security/gitlab!659

Fix null byte error in upload path

See merge request gitlab-org/security/gitlab!573

Resolve "Cross-Site Scripting In BitbucketServer Import"

See merge request gitlab-org/security/gitlab!679

Fix note author name rendering

See merge request gitlab-org/security/gitlab!658

Disable github import api by seetings

See merge request gitlab-org/security/gitlab!559

Fixed group deploy token API authorizations

See merge request gitlab-org/security/gitlab!676

Change from hybrid to JSON cookies serializer

See merge request gitlab-org/security/gitlab!691

Drew Blessing authored 4 years ago and GitLab Release Tools Bot committed 4 years ago

JSON has been the default serializer since Rails 4.1. Hybrid
serializer was meant to allow backward compatibility when
upgrading pre-Rails 4.1. It's been some time since we upgraded
to Rails 4.1 so now we don't need the hybrid serializer anymore.
This also causes security concerns since the previous serializer
was Marshal.

Stored XSS on the Error Tracking page

See merge request gitlab-org/security/gitlab!626

Upgrade swagger-ui to solve XSS issues

See merge request gitlab-org/security/gitlab!636

Validate group names with Rails HTML sanitizer

See merge request gitlab-org/security/gitlab!630

Fix XSS in Banzai's `#data_attributes_for`

See merge request gitlab-org/security/gitlab!599

Update xterm js dependency to latest stable 3.X version

See merge request gitlab-org/security/gitlab!607

Update permissions for time tracking endpoints

See merge request gitlab-org/security/gitlab!617

Update Kaminari gem

See merge request gitlab-org/security/gitlab!670

Make sure user info is sanitized when rendered

See merge request gitlab-org/security/gitlab!597

Merge branch 'security-fix_project_authorizations_for_security_dashboard-13-0' into '13-0-stable-ee'

Security fix project authorizations for security dashboard

See merge request gitlab-org/security/gitlab!583

Fixes pypi XSS

See merge request gitlab-org/security/gitlab!557

[ci skip]

[ci skip]

Prepare 13.0.7-ee release

See merge request gitlab-org/gitlab!35243

Cherry picks !34071 into 13.0 prep branch

See merge request gitlab-org/gitlab!35270

Periodically recompute project authorizations

See merge request gitlab-org/gitlab!34071

Cherry-picks !34923 into 13.0 prep branch

See merge request gitlab-org/gitlab!35272

Stan Hu authored 4 years ago and Mayra Cabrera committed 4 years ago

Load user before logging git http-requests

Closes #223027

See merge request gitlab-org/gitlab!34923

Fixes 13.0 latest prep branch

See merge request gitlab-org/gitlab!35277

- This variable can be used in a Prometheus query, when you want a value
equalling the range of the dashboard/chart.

- If the range of the dashboard is 8 hours, '28800s' will be
substituted in place of __range.