[ci skip]

[ci skip]

Merge branch 'security-fj-add-snippet-repository-validation-bundle-import-13-1' into '13-1-stable-ee'

Lack of validations importing snippet repository from bundle

See merge request gitlab-org/security/gitlab!648

Do not show activity for users with private profiles

See merge request gitlab-org/security/gitlab!687

Check access when sending TODOs related to merge requests

See merge request gitlab-org/security/gitlab!672

Disable caching for wiki attachments

See merge request gitlab-org/security/gitlab!657

Fix null byte error in upload path

See merge request gitlab-org/security/gitlab!666

Resolve "Cross-Site Scripting In BitbucketServer Import"

See merge request gitlab-org/security/gitlab!258

Fix note author name rendering

See merge request gitlab-org/security/gitlab!668

Disable github import api by seetings

See merge request gitlab-org/security/gitlab!650

Fixed group deploy token API authorizations

See merge request gitlab-org/security/gitlab!677

Change from hybrid to JSON cookies serializer

See merge request gitlab-org/security/gitlab!690

Drew Blessing authored 4 years ago and GitLab Release Tools Bot committed 4 years ago

JSON has been the default serializer since Rails 4.1. Hybrid
serializer was meant to allow backward compatibility when
upgrading pre-Rails 4.1. It's been some time since we upgraded
to Rails 4.1 so now we don't need the hybrid serializer anymore.
This also causes security concerns since the previous serializer
was Marshal.

Stored XSS on the Error Tracking page

See merge request gitlab-org/security/gitlab!680

Upgrade swagger-ui to solve XSS issues

See merge request gitlab-org/security/gitlab!640

Validate group names with Rails HTML sanitizer

See merge request gitlab-org/security/gitlab!647

Fix XSS in Banzai's `#data_attributes_for`

See merge request gitlab-org/security/gitlab!678

Update xterm js dependency to latest stable 3.X version

See merge request gitlab-org/security/gitlab!649

Update permissions for time tracking endpoints

See merge request gitlab-org/security/gitlab!621

Update Kaminari gem

See merge request gitlab-org/security/gitlab!669

Make sure user info is sanitized when rendered

See merge request gitlab-org/security/gitlab!598

Merge branch 'security-fix_project_authorizations_for_security_dashboard-13-1' into '13-1-stable-ee'

Security fix project authorizations for security dashboard

See merge request gitlab-org/security/gitlab!585

Fixes pypi XSS

See merge request gitlab-org/security/gitlab!686

[ci skip]

[ci skip]

Prepare 13.1.1-ee release

See merge request gitlab-org/gitlab!35149

Cherry pick !34071 into 13-1-stable prep branch

See merge request gitlab-org/gitlab!35164

Periodically recompute project authorizations

See merge request gitlab-org/gitlab!34071

Solve conflicts templating vars

See merge request gitlab-org/gitlab!35167

Dhiraj Bodicherla authored 4 years ago and Jose Ivan Vargas Lopez committed 4 years ago

Templating variables in metrics dashboards are not
merged with the variables passed from in the URL. This
MR fixes it

Robert Speicher authored 4 years ago and GitLab Release Tools Bot committed 4 years ago

Do not mask key comments for DeployKeys

Closes #223218

See merge request gitlab-org/gitlab!35014

(cherry picked from commit d69392f5)

18e78f1d Do not mask key comments for DeployKeys

Stan Hu authored 4 years ago and GitLab Release Tools Bot committed 4 years ago

Load user before logging git http-requests

Closes #223027

See merge request gitlab-org/gitlab!34923

(cherry picked from commit 7b3cef62)

c9d3671c Load user before logging git http-requests