Merge branch 'master' into 51306-fix-inaccessible-dropdown-for-codeless-projects

.eslintrc.yml

----
 env:
   browser: true
   es6: true
 extends:
   - airbnb-base
+  - prettier
   - plugin:vue/recommended
 globals:
   __webpack_public_path__: true
@@ -19,34 +19,31 @@ plugins:
   - promise
 settings:
   html/html-extensions:
-  - ".html"
-  - ".html.raw"
+    - '.html'
+    - '.html.raw'
   import/resolver:
     webpack:
-      config: "./config/webpack.config.js"
+      config: './config/webpack.config.js'
 rules:
   filenames/match-regex:
     - error
-    - "^[a-z0-9_]+$"
+    - '^[a-z0-9_]+$'
   import/no-commonjs: error
-  no-multiple-empty-lines:
-    - error
-    - max: 1
   promise/catch-or-return: error
   no-param-reassign:
     - error
     - props: true
       ignorePropertyModificationsFor:
-        - "acc"         # for reduce accumulators
-        - "accumulator" # for reduce accumulators
-        - "el"          # for DOM elements
-        - "element"     # for DOM elements
-        - "state"       # for Vuex mutations
+        - 'acc' # for reduce accumulators
+        - 'accumulator' # for reduce accumulators
+        - 'el' # for DOM elements
+        - 'element' # for DOM elements
+        - 'state' # for Vuex mutations
   no-underscore-dangle:
     - error
     - allow:
-      - __
-      - _links
+        - __
+        - _links
   no-mixed-operators: off
   vue/html-self-closing:
     - error
@@ -60,31 +57,7 @@ rules:
     - error
     - properties: never
       ignoreDestructuring: true
-  ## Conflicting rules with prettier:
-  space-before-function-paren: off
-  curly: off
-  arrow-parens: off
-  function-paren-newline: off
-  object-curly-newline: off
-  padded-blocks: off
-  # Disabled for now, to make the eslint 3 -> eslint 5 update smoother
-  ## Indent rule. We are using the old for now: https://eslint.org/docs/user-guide/migrating-to-4.0.0#indent-rewrite
-  indent: off
-  indent-legacy:
-    - error
-    - 2
-    - SwitchCase: 1
-      VariableDeclarator: 1
-      outerIIFEBody: 1
-      FunctionDeclaration:
-        parameters: 1
-        body: 1
-      FunctionExpression:
-        parameters: 1
-        body: 1
   # Disabled for now, to make the airbnb-base 12.1.0 -> 13.1.0 update smoother
-  operator-linebreak: off
-  implicit-arrow-linebreak: off
   no-else-return:
     - error
     - allowElseIf: true

.gitlab/CODEOWNERS

@@ -16,3 +16,5 @@ db/ @abrandl @NikolayS
 /ee/lib/gitlab/code_owners/ @reprazent
 /ee/lib/ee/gitlab/auth/ldap/ @dblessing @mkozono
 /lib/gitlab/auth/ldap/ @dblessing @mkozono
+/lib/gitlab/ci/templates/ @nolith @zj
+/lib/gitlab/ci/templates/Auto-DevOps.gitlab-ci.yml @DylanGriffith @mayra-cabrera @tkuah

.rubocop.yml

@@ -3,7 +3,9 @@ inherit_gem:
     - rubocop-default.yml
 inherit_from: .rubocop_todo.yml
-require: ./rubocop/rubocop
+require:
+  - ./rubocop/rubocop
+  - rubocop-rspec
 AllCops:
   TargetRailsVersion: 4.2
@@ -48,12 +50,20 @@ Style/FrozenStringLiteralComment:
     - 'danger/**/*'
     - 'db/**/*'
     - 'ee/**/*'
-    - 'lib/**/*'
+    - 'lib/gitlab/**/*'
+    - 'lib/tasks/**/*'
     - 'qa/**/*'
     - 'rubocop/**/*'
     - 'scripts/**/*'
     - 'spec/**/*'
+RSpec/FilePath:
+  Exclude:
+    - 'qa/**/*'
+    - 'spec/javascripts/fixtures/*'
+    - 'ee/spec/javascripts/fixtures/*'
+    - 'spec/requests/api/v3/*'
+
 Naming/FileName:
   ExpectMatchingDefinition: true
   Exclude:
@@ -75,6 +85,7 @@ Naming/FileName:
     - EE
     - JSON
     - LDAP
+    - SAML
     - IO
     - HMAC
     - QA

CHANGELOG.md

@@ -279,6 +279,15 @@ entry.
 - Creates Vue component for artifacts block on job page.
+## 11.2.5 (2018-10-05)
+
+### Security (3 changes)
+
+- Filter user sensitive data from discussions JSON. !2538
+- Properly filter private references from system notes.
+- Markdown API no longer displays confidential title references unless authorized.
+
+
 ## 11.2.4 (2018-09-26)
 ### Security (6 changes)
@@ -558,6 +567,15 @@ entry.
 - Moves help_popover component to a common location.
+## 11.1.8 (2018-10-05)
+
+### Security (3 changes)
+
+- Filter user sensitive data from discussions JSON. !2539
+- Properly filter private references from system notes.
+- Markdown API no longer displays confidential title references unless authorized.
+
+
 ## 11.1.7 (2018-09-26)
 ### Security (6 changes)

CONTRIBUTING.md

@@ -92,35 +92,79 @@ Please report suspected security vulnerabilities in private to
 Please do **NOT** create publicly viewable issues for suspected security
 vulnerabilities.
-## Code of conduct
-As contributors and maintainers of this project, we pledge to respect all
-people who contribute through reporting issues, posting feature requests,
-updating documentation, submitting pull requests or patches, and other
-activities.
-We are committed to making participation in this project a harassment-free
-experience for everyone, regardless of level of experience, gender, gender
-identity and expression, sexual orientation, disability, personal appearance,
-body size, race, ethnicity, age, or religion.
-Examples of unacceptable behavior by participants include the use of sexual
-language or imagery, derogatory comments or personal attacks, trolling, public
-or private harassment, insults, or other unprofessional conduct.
+## Code of Conduct
+### Our Pledge
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+### Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+### Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
 Project maintainers have the right and responsibility to remove, edit, or
 reject comments, commits, code, wiki edits, issues, and other contributions
-that are not aligned to this Code of Conduct. Project maintainers who do not
-follow the Code of Conduct may be removed from the project team.
-This code of conduct applies both within project spaces and in public spaces
-when an individual is representing the project or its community.
-Instances of abusive, harassing, or otherwise unacceptable behavior can be
-reported by emailing `contact@gitlab.com`.
-This Code of Conduct is adapted from the [Contributor Covenant][contributor-covenant], version 1.1.0,
-available at [http://contributor-covenant.org/version/1/1/0/](http://contributor-covenant.org/version/1/1/0/).
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+### Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+### Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at conduct@gitlab.com. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+### Attribution
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+[homepage]: https://www.contributor-covenant.org
 ## Closing policy for issues and merge requests

GITALY_SERVER_VERSION

-0.124.0
+0.125.0

GITLAB_PAGES_VERSION

-1.1.0
+1.2.1

GITLAB_SHELL_VERSION

-8.3.3
+8.4.0
\ No newline at end of file

Gemfile.lock

@@ -797,7 +797,7 @@ GEM
     rubyzip (1.2.2)
     rufus-scheduler (3.4.0)
       et-orbi (~> 1.0)
-    rugged (0.27.4)
+    rugged (0.27.5)
     safe_yaml (1.0.4)
     sanitize (4.6.6)
       crass (~> 1.0.2)

Gemfile.rails5.lock

@@ -805,7 +805,7 @@ GEM
     rubyzip (1.2.2)
     rufus-scheduler (3.4.0)
       et-orbi (~> 1.0)
-    rugged (0.27.4)
+    rugged (0.27.5)
     safe_yaml (1.0.4)
     sanitize (4.6.6)
       crass (~> 1.0.2)

PROCESS.md

@@ -208,6 +208,7 @@ the stable branch are:
 * Fixes or improvements to automated QA scenarios
 * [Documentation updates](https://docs.gitlab.com/ee/development/documentation/workflow.html#documentation-shipped-late) for changes in the same release
 * New or updated translations (as long as they do not touch application code)
+* Changes that are behind a feature flag and have the ~"feature flag" label
 During the feature freeze all merge requests that are meant to go into the
 upcoming release should have the correct milestone assigned _and_ the

app/assets/javascripts/api.js

@@ -15,12 +15,9 @@ const Api = {
   mergeRequestChangesPath: '/api/:version/projects/:id/merge_requests/:mrid/changes',
   mergeRequestVersionsPath: '/api/:version/projects/:id/merge_requests/:mrid/versions',
   groupLabelsPath: '/groups/:namespace_path/-/labels',
-  templatesPath: '/api/:version/templates/:key',
-  licensePath: '/api/:version/templates/licenses/:key',
-  gitignorePath: '/api/:version/templates/gitignores/:key',
-  gitlabCiYmlPath: '/api/:version/templates/gitlab_ci_ymls/:key',
-  dockerfilePath: '/api/:version/templates/dockerfiles/:key',
   issuableTemplatePath: '/:namespace_path/:project_path/templates/:type/:key',
+  projectTemplatePath: '/api/:version/projects/:id/templates/:type/:key',
+  projectTemplatesPath: '/api/:version/projects/:id/templates/:type',
   usersPath: '/api/:version/users.json',
   userStatusPath: '/api/:version/user/status',
   commitPath: '/api/:version/projects/:id/repository/commits',
@@ -196,29 +193,29 @@ const Api = {
     return axios.get(url);
   },
-  // Return text for a specific license
-  licenseText(key, data, callback) {
-    const url = Api.buildUrl(Api.licensePath).replace(':key', key);
-    return axios
-      .get(url, {
-        params: data,
-      })
-      .then(res => callback(res.data));
-  },
-  gitignoreText(key, callback) {
-    const url = Api.buildUrl(Api.gitignorePath).replace(':key', key);
-    return axios.get(url).then(({ data }) => callback(data));
-  },
-  gitlabCiYml(key, callback) {
-    const url = Api.buildUrl(Api.gitlabCiYmlPath).replace(':key', key);
-    return axios.get(url).then(({ data }) => callback(data));
+  projectTemplate(id, type, key, options, callback) {
+    const url = Api.buildUrl(this.projectTemplatePath)
+      .replace(':id', encodeURIComponent(id))
+      .replace(':type', type)
+      .replace(':key', encodeURIComponent(key));
+    return axios.get(url, { params: options }).then(res => {
+      if (callback) callback(res.data);
+      return res;
+    });
   },
-  dockerfileYml(key, callback) {
-    const url = Api.buildUrl(Api.dockerfilePath).replace(':key', key);
-    return axios.get(url).then(({ data }) => callback(data));
+  projectTemplates(id, type, params = {}, callback) {
+    const url = Api.buildUrl(this.projectTemplatesPath)
+      .replace(':id', encodeURIComponent(id))
+      .replace(':type', type);
+
+    return axios.get(url, { params }).then(res => {
+      if (callback) callback(res.data);
+
+      return res;
+    });
   },
   issueTemplate(namespacePath, projectPath, key, type, callback) {
@@ -276,12 +273,6 @@ const Api = {
     });
   },
-  templates(key, params = {}) {
-    const url = Api.buildUrl(this.templatesPath).replace(':key', key);
-
-    return axios.get(url, { params });
-  },
-
   buildUrl(url) {
     let urlRoot = '';
     if (gon.relative_url_root != null) {

app/assets/javascripts/behaviors/markdown/copy_as_gfm.js

-/* eslint-disable object-shorthand, no-unused-vars, no-use-before-define, max-len, no-restricted-syntax, guard-for-in, no-continue */
+/* eslint-disable object-shorthand, no-unused-vars, no-use-before-define, no-restricted-syntax, guard-for-in, no-continue */
 import $ from 'jquery';
 import _ from 'underscore';

app/assets/javascripts/blob/file_template_mediator.js

-/* eslint-disable class-methods-use-this */
+import Api from '~/api';
 import $ from 'jquery';
 import Flash from '../flash';
@@ -9,9 +9,10 @@ import GitignoreSelector from './template_selectors/gitignore_selector';
 import LicenseSelector from './template_selectors/license_selector';
 export default class FileTemplateMediator {
-  constructor({ editor, currentAction }) {
+  constructor({ editor, currentAction, projectId }) {
     this.editor = editor;
     this.currentAction = currentAction;
+    this.projectId = projectId;
     this.initTemplateSelectors();
     this.initTemplateTypeSelector();
@@ -33,15 +34,14 @@ export default class FileTemplateMediator {
   initTemplateTypeSelector() {
     this.typeSelector = new FileTemplateTypeSelector({
       mediator: this,
-      dropdownData: this.templateSelectors
-        .map((templateSelector) => {
-          const cfg = templateSelector.config;
-
-          return {
-            name: cfg.name,
-            key: cfg.key,
-          };
-        }),
+      dropdownData: this.templateSelectors.map(templateSelector => {
+        const cfg = templateSelector.config;
+
+        return {
+          name: cfg.name,
+          key: cfg.key,
+        };
+      }),
     });
   }
@@ -89,7 +89,7 @@ export default class FileTemplateMediator {
   }
   listenForPreviewMode() {
-    this.$navLinks.on('click', 'a', (e) => {
+    this.$navLinks.on('click', 'a', e => {
       const urlPieces = e.target.href.split('#');
       const hash = urlPieces[1];
       if (hash === 'preview') {
@@ -105,7 +105,7 @@ export default class FileTemplateMediator {
       e.preventDefault();
     }
-    this.templateSelectors.forEach((selector) => {
+    this.templateSelectors.forEach(selector => {
       if (selector.config.key === item.key) {
         selector.show();
       } else {
@@ -126,8 +126,8 @@ export default class FileTemplateMediator {
     selector.renderLoading();
     // in case undo menu is already already there
     this.destroyUndoMenu();
-    this.fetchFileTemplate(selector.config.endpoint, query, data)
-      .then((file) => {
+    this.fetchFileTemplate(selector.config.type, query, data)
+      .then(file => {
         this.showUndoMenu();
         this.setEditorContent(file);
         this.setFilename(selector.config.name);
@@ -138,7 +138,7 @@ export default class FileTemplateMediator {
   displayMatchedTemplateSelector() {
     const currentInput = this.getFilename();
-    this.templateSelectors.forEach((selector) => {
+    this.templateSelectors.forEach(selector => {
       const match = selector.config.pattern.test(currentInput);
       if (match) {
@@ -149,15 +149,11 @@ export default class FileTemplateMediator {
     });
   }
-  fetchFileTemplate(apiCall, query, data) {
-    return new Promise((resolve) => {
+  fetchFileTemplate(type, query, data = {}) {
+    return new Promise(resolve => {
       const resolveFile = file => resolve(file);
-      if (!data) {
-        apiCall(query, resolveFile);
-      } else {
-        apiCall(query, data, resolveFile);
-      }
+      Api.projectTemplate(this.projectId, type, query, data, resolveFile);
     });
   }

app/assets/javascripts/blob/template_selector.js

@@ -66,9 +66,6 @@ export default class TemplateSelector {
     // be added by all subclasses.
   }
-  // To be implemented on the extending class
-  // e.g. Api.gitlabCiYml(query.name, file => this.setEditorContent(file));
-
   setEditorContent(file, { skipFocus } = {}) {
     if (!file) return;

app/assets/javascripts/blob/template_selectors/ci_yaml_selector.js

-import Api from '../../api';
-
 import FileTemplateSelector from '../file_template_selector';
 export default class BlobCiYamlSelector extends FileTemplateSelector {
@@ -9,7 +7,7 @@ export default class BlobCiYamlSelector extends FileTemplateSelector {
       key: 'gitlab-ci-yaml',
       name: '.gitlab-ci.yml',
       pattern: /(.gitlab-ci.yml)/,
-      endpoint: Api.gitlabCiYml,
+      type: 'gitlab_ci_ymls',
       dropdown: '.js-gitlab-ci-yml-selector',
       wrapper: '.js-gitlab-ci-yml-selector-wrap',
     };

app/assets/javascripts/blob/template_selectors/dockerfile_selector.js

-import Api from '../../api';
-
 import FileTemplateSelector from '../file_template_selector';
 export default class DockerfileSelector extends FileTemplateSelector {
@@ -9,7 +7,7 @@ export default class DockerfileSelector extends FileTemplateSelector {
       key: 'dockerfile',
       name: 'Dockerfile',
       pattern: /(Dockerfile)/,
-      endpoint: Api.dockerfileYml,
+      type: 'dockerfiles',
       dropdown: '.js-dockerfile-selector',
       wrapper: '.js-dockerfile-selector-wrap',
     };

app/assets/javascripts/blob/template_selectors/gitignore_selector.js

-import Api from '../../api';
-
 import FileTemplateSelector from '../file_template_selector';
 export default class BlobGitignoreSelector extends FileTemplateSelector {
@@ -9,7 +7,7 @@ export default class BlobGitignoreSelector extends FileTemplateSelector {
       key: 'gitignore',
       name: '.gitignore',
       pattern: /(.gitignore)/,
-      endpoint: Api.gitignoreText,
+      type: 'gitignores',
       dropdown: '.js-gitignore-selector',
       wrapper: '.js-gitignore-selector-wrap',
     };