Add latest changes from gitlab-org/gitlab@master

.gitignore

@@ -59,6 +59,7 @@ eslint-report.html
 /public/uploads.*
 /public/uploads/
 /shared/artifacts/
+/spec/examples.txt
 /rails_best_practices_output.html
 /tags
 /vendor/bundle/*

.gitlab/ci/qa.gitlab-ci.yml

@@ -66,3 +66,4 @@ schedule:package-and-qa:
     - .default-only
     - .only:variables_refs-canonical-dot-com-schedules
   needs: ["build-qa-image", "gitlab:assets:compile pull-cache"]
+  allow_failure: true

Gemfile

@@ -64,7 +64,7 @@ gem 'u2f', '~> 0.2.1'
 # GitLab Pages
 gem 'validates_hostname', '~> 1.0.6'
-gem 'rubyzip', '~> 1.2.2', require: 'zip'
+gem 'rubyzip', '~> 1.3.0', require: 'zip'
 # GitLab Pages letsencrypt support
 gem 'acme-client', '~> 2.0.2'
@@ -72,7 +72,7 @@ gem 'acme-client', '~> 2.0.2'
 gem 'browser', '~> 2.5'
 # GPG
-gem 'gpgme', '~> 2.0.18'
+gem 'gpgme', '~> 2.0.19'
 # LDAP Auth
 # GitLab fork with several improvements to original library. For full list of changes
@@ -151,7 +151,7 @@ gem 'asciidoctor-plantuml', '0.0.9'
 gem 'rouge', '~> 3.11.0'
 gem 'truncato', '~> 0.7.11'
 gem 'bootstrap_form', '~> 4.2.0'
-gem 'nokogiri', '~> 1.10.4'
+gem 'nokogiri', '~> 1.10.5'
 gem 'escape_utils', '~> 1.1'
 # Calendar rendering

Gemfile.lock

@@ -411,7 +411,7 @@ GEM
       multi_json (~> 1.11)
       os (>= 0.9, < 2.0)
       signet (~> 0.7)
-    gpgme (2.0.18)
+    gpgme (2.0.19)
       mini_portile2 (~> 2.3)
     grape (1.1.0)
       activesupport
@@ -902,7 +902,7 @@ GEM
       sexp_processor (~> 4.9)
     rubyntlm (0.6.2)
     rubypants (0.2.0)
-    rubyzip (1.2.2)
+    rubyzip (1.3.0)
     rugged (0.28.3.1)
     safe_yaml (1.0.4)
     sanitize (4.6.6)
@@ -1183,7 +1183,7 @@ DEPENDENCIES
   gon (~> 6.2)
   google-api-client (~> 0.23)
   google-protobuf (~> 3.8.0)
-  gpgme (~> 2.0.18)
+  gpgme (~> 2.0.19)
   grape (~> 1.1.0)
   grape-entity (~> 0.7.1)
   grape-path-helpers (~> 1.1)
@@ -1227,7 +1227,7 @@ DEPENDENCIES
   net-ldap
   net-ntp
   net-ssh (~> 5.2)
-  nokogiri (~> 1.10.4)
+  nokogiri (~> 1.10.5)
   oauth2 (~> 1.4)
   octokit (~> 4.9)
   omniauth (~> 1.8)
@@ -1293,7 +1293,7 @@ DEPENDENCIES
   ruby-prof (~> 1.0.0)
   ruby-progressbar
   ruby_parser (~> 3.8)
-  rubyzip (~> 1.2.2)
+  rubyzip (~> 1.3.0)
   rugged (~> 0.28)
   sanitize (~> 4.6)
   sassc-rails (~> 2.1.0)

app/assets/javascripts/issuables_list/components/issuable.vue

@@ -54,6 +54,11 @@ export default {
     },
   },
   computed: {
+    milestoneLink() {
+      const { title } = this.issuable.milestone;
+
+      return this.issuableLink({ milestone_title: title });
+    },
     hasLabels() {
       return Boolean(this.issuable.labels && this.issuable.labels.length);
     },
@@ -167,8 +172,11 @@ export default {
         color: label.text_color,
       };
     },
+    issuableLink(params) {
+      return mergeUrlParams(params, this.baseUrl);
+    },
     labelHref({ name }) {
-      return mergeUrlParams({ 'label_name[]': name }, this.baseUrl);
+      return this.issuableLink({ 'label_name[]': name });
     },
     onSelect(ev) {
       this.$emit('select', {
@@ -216,9 +224,9 @@ export default {
             ></i>
             <gl-link :href="issuable.web_url">{{ issuable.title }}</gl-link>
           </span>
-          <span v-if="issuable.has_tasks" class="ml-1 task-status d-none d-sm-inline-block">
-            {{ issuable.task_status }}
-          </span>
+          <span v-if="issuable.has_tasks" class="ml-1 task-status d-none d-sm-inline-block">{{
+            issuable.task_status
+          }}</span>
         </div>
         <div class="issuable-info">
@@ -233,7 +241,7 @@ export default {
             v-if="issuable.milestone"
             v-gl-tooltip
             class="d-none d-sm-inline-block mr-1 js-milestone"
-            :href="issuable.milestone.web_url"
+            :href="milestoneLink"
             :title="milestoneTooltipText"
           >
             <i class="fa fa-clock-o"></i>

app/assets/javascripts/profile/gl_crop.js

-/* eslint-disable no-useless-escape, no-var, no-underscore-dangle, func-names, no-return-assign, one-var, consistent-return, class-methods-use-this */
+/* eslint-disable no-useless-escape, no-underscore-dangle, func-names, no-return-assign, consistent-return, class-methods-use-this */
 import $ from 'jquery';
 import 'cropper';
@@ -59,8 +59,7 @@ import _ from 'underscore';
     }
     bindEvents() {
-      var _this;
-      _this = this;
+      const _this = this;
       this.fileInput.on('change', function(e) {
         _this.onFileInputChange(e, this);
         this.value = null;
@@ -70,8 +69,7 @@ import _ from 'underscore';
       this.modalCrop.on('hidden.bs.modal', this.onModalHide);
       this.uploadImageBtn.on('click', this.onUploadImageBtnClick);
       this.cropActionsBtn.on('click', function() {
-        var btn;
-        btn = this;
+        const btn = this;
         return _this.onActionBtnClick(btn);
       });
       return (this.croppedImageBlob = null);
@@ -82,8 +80,7 @@ import _ from 'underscore';
     }
     onModalShow() {
-      var _this;
-      _this = this;
+      const _this = this;
       return this.modalCropImg.cropper({
         viewMode: 1,
         center: false,
@@ -128,8 +125,7 @@ import _ from 'underscore';
     }
     onActionBtnClick(btn) {
-      var data;
-      data = $(btn).data();
+      const data = $(btn).data();
       if (this.modalCropImg.data('cropper') && data.method) {
         return this.modalCropImg.cropper(data.method, data.option);
       }
@@ -140,9 +136,8 @@ import _ from 'underscore';
     }
     readFile(input) {
-      var _this, reader;
-      _this = this;
-      reader = new FileReader();
+      const _this = this;
+      const reader = new FileReader();
       reader.onload = () => {
         _this.modalCropImg.attr('src', reader.result);
         return _this.modalCrop.modal('show');
@@ -151,9 +146,10 @@ import _ from 'underscore';
     }
     dataURLtoBlob(dataURL) {
-      var array, binary, i, len;
-      binary = atob(dataURL.split(',')[1]);
-      array = [];
+      let i = 0;
+      let len = 0;
+      const binary = atob(dataURL.split(',')[1]);
+      const array = [];
       for (i = 0, len = binary.length; i < len; i += 1) {
         array.push(binary.charCodeAt(i));
@@ -164,9 +160,8 @@ import _ from 'underscore';
     }
     setPreview() {
-      var filename;
+      const filename = this.fileInput.val().replace(FILENAMEREGEX, '');
       this.previewImage.attr('src', this.dataURL);
-      filename = this.fileInput.val().replace(FILENAMEREGEX, '');
       return this.filename.text(filename);
     }

app/assets/javascripts/sidebar/components/subscriptions/sidebar_subscriptions.vue

@@ -33,6 +33,8 @@ export default {
   <div class="block subscriptions">
     <subscriptions
       :loading="store.isFetching.subscriptions"
+      :project-emails-disabled="store.projectEmailsDisabled"
+      :subscribe-disabled-description="store.subscribeDisabledDescription"
       :subscribed="store.subscribed"
       @toggleSubscription="onToggleSubscription"
     />

app/assets/javascripts/sidebar/components/subscriptions/subscriptions.vue

@@ -26,6 +26,16 @@ export default {
       required: false,
       default: false,
     },
+    projectEmailsDisabled: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    subscribeDisabledDescription: {
+      type: String,
+      required: false,
+      default: '',
+    },
     subscribed: {
       type: Boolean,
       required: false,
@@ -42,11 +52,23 @@ export default {
       return this.subscribed === null;
     },
     notificationIcon() {
+      if (this.projectEmailsDisabled) {
+        return ICON_OFF;
+      }
       return this.subscribed ? ICON_ON : ICON_OFF;
     },
     notificationTooltip() {
+      if (this.projectEmailsDisabled) {
+        return this.subscribeDisabledDescription;
+      }
       return this.subscribed ? LABEL_ON : LABEL_OFF;
     },
+    notificationText() {
+      if (this.projectEmailsDisabled) {
+        return this.subscribeDisabledDescription;
+      }
+      return __('Notifications');
+    },
   },
   methods: {
     /**
@@ -81,6 +103,7 @@ export default {
 <template>
   <div>
     <span
+      ref="tooltip"
       v-tooltip
       class="sidebar-collapsed-icon"
       :title="notificationTooltip"
@@ -96,8 +119,9 @@ export default {
         class="sidebar-item-icon is-active"
       />
     </span>
-    <span class="issuable-header-text hide-collapsed float-left"> {{ __('Notifications') }} </span>
+    <span class="issuable-header-text hide-collapsed float-left"> {{ notificationText }} </span>
     <toggle-button
+      v-if="!projectEmailsDisabled"
       ref="toggleButton"
       :is-loading="showLoadingState"
       :value="subscribed"

app/assets/javascripts/sidebar/stores/sidebar_store.js

@@ -28,6 +28,8 @@ export default class SidebarStore {
     this.moveToProjectId = 0;
     this.isLockDialogOpen = false;
     this.participants = [];
+    this.projectEmailsDisabled = false;
+    this.subscribeDisabledDescription = '';
     this.subscribed = null;
     SidebarStore.singleton = this;
@@ -53,6 +55,8 @@ export default class SidebarStore {
   }
   setSubscriptionsData(data) {
+    this.projectEmailsDisabled = data.project_emails_disabled || false;
+    this.subscribeDisabledDescription = data.subscribe_disabled_description;
     this.isFetching.subscriptions = false;
     this.subscribed = data.subscribed || false;
   }

app/controllers/application_controller.rb

@@ -20,11 +20,11 @@ class ApplicationController < ActionController::Base
   before_action :authenticate_user!, except: [:route_not_found]
   before_action :enforce_terms!, if: :should_enforce_terms?
   before_action :validate_user_service_ticket!
-  before_action :check_password_expiration, if: :html_request?
+  before_action :check_password_expiration
   before_action :ldap_security_check
   before_action :sentry_context
   before_action :default_headers
-  before_action :add_gon_variables, if: :html_request?
+  before_action :add_gon_variables, unless: [:peek_request?, :json_request?]
   before_action :configure_permitted_parameters, if: :devise_controller?
   before_action :require_email, unless: :devise_controller?
   before_action :active_user_check, unless: :devise_controller?
@@ -455,8 +455,8 @@ class ApplicationController < ActionController::Base
     response.headers['Page-Title'] = URI.escape(page_title('GitLab'))
   end
-  def html_request?
-    request.format.html?
+  def peek_request?
+    request.path.start_with?('/-/peek')
   end
   def json_request?
@@ -466,7 +466,7 @@ class ApplicationController < ActionController::Base
   def should_enforce_terms?
     return false unless Gitlab::CurrentSettings.current_application_settings.enforce_terms
-    html_request? && !devise_controller?
+    !(peek_request? || devise_controller?)
   end
   def set_usage_stats_consent_flag

app/controllers/concerns/confirm_email_warning.rb

@@ -4,18 +4,15 @@ module ConfirmEmailWarning
   extend ActiveSupport::Concern
   included do
-    before_action :set_confirm_warning, if: :show_confirm_warning?
+    before_action :set_confirm_warning, if: -> { Feature.enabled?(:soft_email_confirmation) }
   end
   protected
-  def show_confirm_warning?
-    html_request? && request.get? && Feature.enabled?(:soft_email_confirmation)
-  end
-
   def set_confirm_warning
     return unless current_user
     return if current_user.confirmed?
+    return if peek_request? || json_request? || !request.get?
     email = current_user.unconfirmed_email || current_user.email

app/controllers/concerns/sourcegraph_gon.rb

@@ -4,7 +4,7 @@ module SourcegraphGon
   extend ActiveSupport::Concern
   included do
-    before_action :push_sourcegraph_gon, if: :html_request?
+    before_action :push_sourcegraph_gon, unless: :json_request?
   end
   private

app/controllers/concerns/uploads_actions.rb

 # frozen_string_literal: true
 module UploadsActions
-  extend ActiveSupport::Concern
   include Gitlab::Utils::StrongMemoize
   include SendFileUpload
   UPLOAD_MOUNTS = %w(avatar attachment file logo header_logo favicon).freeze
-  included do
-    prepend_before_action :set_request_format_from_path_extension
-  end
-
   def create
     uploader = UploadService.new(model, params[:file], uploader_class).execute
@@ -69,18 +64,6 @@ module UploadsActions
   private
-  # From ActionDispatch::Http::MimeNegotiation. We have an initializer that
-  # monkey-patches this method out (so that repository paths don't guess a
-  # format based on extension), but we do want this behaviour when serving
-  # uploads.
-  def set_request_format_from_path_extension
-    path = request.headers['action_dispatch.original_path'] || request.headers['PATH_INFO']
-
-    if match = path&.match(/\.(\w+)\z/)
-      request.format = match.captures.first
-    end
-  end
-
   def uploader_class
     raise NotImplementedError
   end

app/models/environment.rb

@@ -4,6 +4,9 @@ class Environment < ApplicationRecord
   include Gitlab::Utils::StrongMemoize
   include ReactiveCaching
+  self.reactive_cache_refresh_interval = 1.minute
+  self.reactive_cache_lifetime = 55.seconds
+
   belongs_to :project, required: true
   has_many :deployments, -> { visible }, dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent

app/serializers/issuable_sidebar_extras_entity.rb

@@ -3,11 +3,20 @@
 class IssuableSidebarExtrasEntity < Grape::Entity
   include RequestAwareEntity
   include TimeTrackableEntity
+  include NotificationsHelper
   expose :participants, using: ::API::Entities::UserBasic do |issuable|
     issuable.participants(request.current_user)
   end
+  expose :project_emails_disabled do |issuable|
+    issuable.project.emails_disabled?
+  end
+
+  expose :subscribe_disabled_description do |issuable|
+    notification_description(:owner_disabled)
+  end
+
   expose :subscribed do |issuable|
     issuable.subscribed?(request.current_user, issuable.project)
   end

app/services/merge_requests/ff_merge_service.rb

@@ -11,19 +11,21 @@ module MergeRequests
     private
     def commit
-      repository.ff_merge(current_user,
-                          source,
-                          merge_request.target_branch,
-                          merge_request: merge_request)
+      ff_merge = repository.ff_merge(current_user,
+                                     source,
+                                     merge_request.target_branch,
+                                     merge_request: merge_request)
+
+      if merge_request.squash
+        merge_request.update_column(:squash_commit_sha, merge_request.in_progress_merge_commit_sha)
+      end
+
+      ff_merge
     rescue Gitlab::Git::PreReceiveError => e
       raise MergeError, e.message
     rescue StandardError => e
       raise MergeError, "Something went wrong during merge: #{e.message}"
     ensure
-      if merge_request.squash
-        merge_request.update_column(:squash_commit_sha, merge_request.in_progress_merge_commit_sha)
-      end
-
       merge_request.update(in_progress_merge_commit_sha: nil)
     end
   end

app/views/shared/issuable/_sidebar.html.haml

@@ -141,13 +141,7 @@
         .js-sidebar-participants-entry-point
         - if signed_in
-          - if issuable_sidebar[:project_emails_disabled]
-            .block.js-emails-disabled
-              .sidebar-collapsed-icon.has-tooltip{ title: notification_description(:owner_disabled), data: { placement: "left", container: "body", boundary: 'viewport' } }
-                = notification_setting_icon
-              .hide-collapsed= notification_description(:owner_disabled)
-          - else
-            .js-sidebar-subscriptions-entry-point
+          .js-sidebar-subscriptions-entry-point
         - project_ref = issuable_sidebar[:reference]
         .block.project-reference

changelogs/unreleased/31184-refactor-disabled-sidebar-notification-to-vue.yml

+---
+title: Refactor disabled sidebar notifications to Vue
+merge_request: 20007
+author: minghuan lei
+type: other

changelogs/unreleased/34564-vulnerability-issue-links.yml

+---
+title: Update the DB schema to allow linking between Vulnerabilities and Issues
+merge_request: 19852
+author:
+type: added

changelogs/unreleased/35618-add-clipboard-button-to-package-registry-information.yml

+---
+title: Adds a copy button next to package metadata on the details page
+merge_request: 19881
+author:
+type: added