Add latest changes from gitlab-org/gitlab@master

CHANGELOG-EE.md

 Please view this file on the master branch, on stable branches it's out of date.
+## 12.5.4
+
+### Security (1 change)
+
+- Fix stale Elasticsearch permissions when moving group from public group to private parent group.
+
+
 ## 12.5.3
 ### Performance (1 change)
@@ -251,6 +258,13 @@ Please view this file on the master branch, on stable branches it's out of date.
 - Docs for protected branch code owner approval API. !17132
+## 12.3.9
+
+### Security (1 change)
+
+- Fix stale Elasticsearch permissions when moving group from public group to private parent group.
+
+
 ## 12.3.7
 ### Security (6 changes)

CHANGELOG.md

@@ -2,6 +2,13 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
+## 12.5.4
+
+### Security (1 change)
+
+- Update maven_file_name_regex for full string match.
+
+
 ## 12.5.3
 ### Fixed (4 changes)
@@ -756,6 +763,13 @@ entry.
 - Remove Postgresql specific setup tasks and move to schema.rb.
+## 12.3.9
+
+### Security (1 change)
+
+- Update maven_file_name_regex for full string match.
+
+
 ## 12.3.7
 ### Security (12 changes)

app/helpers/award_emoji_helper.rb

@@ -7,7 +7,7 @@ module AwardEmojiHelper
     if awardable.is_a?(Note)
       # We render a list of notes very frequently and calling the specific method is a lot faster than the generic one (4.5x)
       if awardable.for_personal_snippet?
-        toggle_award_emoji_snippet_note_path(awardable.noteable, awardable)
+        gitlab_toggle_award_emoji_snippet_note_path(awardable.noteable, awardable)
       else
         toggle_award_emoji_project_note_path(@project, awardable.id)
       end

app/helpers/blob_helper.rb

@@ -141,7 +141,7 @@ module BlobHelper
     if @build && @entry
       raw_project_job_artifacts_url(@project, @build, path: @entry.path, **kwargs)
     elsif @snippet
-      raw_snippet_url(@snippet)
+      gitlab_raw_snippet_url(@snippet)
     elsif @blob
       project_raw_url(@project, @id, **kwargs)
     end

app/helpers/gitlab_routing_helper.rb

@@ -194,88 +194,84 @@ module GitlabRoutingHelper
     take_ownership_project_pipeline_schedule_path(project, schedule, *args)
   end
-  def snippet_path(snippet, *args)
-    if snippet.type == "ProjectSnippet"
-      application_url_helpers.project_snippet_path(snippet.project, snippet, *args)
+  def gitlab_snippet_path(snippet, *args)
+    if snippet.is_a?(ProjectSnippet)
+      project_snippet_path(snippet.project, snippet, *args)
     else
       new_args = snippet_query_params(snippet, *args)
-      application_url_helpers.snippet_path(snippet, *new_args)
+      snippet_path(snippet, *new_args)
     end
   end
-  def snippet_url(snippet, *args)
-    if snippet.type == "ProjectSnippet"
-      application_url_helpers.project_snippet_url(snippet.project, snippet, *args)
+  def gitlab_snippet_url(snippet, *args)
+    if snippet.is_a?(ProjectSnippet)
+      project_snippet_url(snippet.project, snippet, *args)
     else
       new_args = snippet_query_params(snippet, *args)
-      application_url_helpers.snippet_url(snippet, *new_args)
+      snippet_url(snippet, *new_args)
     end
   end
-  def raw_snippet_path(snippet, *args)
-    if snippet.type == "ProjectSnippet"
-      application_url_helpers.raw_project_snippet_path(snippet.project, snippet, *args)
+  def gitlab_raw_snippet_path(snippet, *args)
+    if snippet.is_a?(ProjectSnippet)
+      raw_project_snippet_path(snippet.project, snippet, *args)
     else
       new_args = snippet_query_params(snippet, *args)
-      application_url_helpers.raw_snippet_path(snippet, *new_args)
+      raw_snippet_path(snippet, *new_args)
     end
   end
-  def raw_snippet_url(snippet, *args)
-    if snippet.type == "ProjectSnippet"
-      application_url_helpers.raw_project_snippet_url(snippet.project, snippet, *args)
+  def gitlab_raw_snippet_url(snippet, *args)
+    if snippet.is_a?(ProjectSnippet)
+      raw_project_snippet_url(snippet.project, snippet, *args)
     else
       new_args = snippet_query_params(snippet, *args)
-      application_url_helpers.raw_snippet_url(snippet, *new_args)
+      raw_snippet_url(snippet, *new_args)
     end
   end
-  def snippet_notes_path(snippet, *args)
+  def gitlab_snippet_notes_path(snippet, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.snippet_notes_path(snippet, *new_args)
+    snippet_notes_path(snippet, *new_args)
   end
-  def snippet_notes_url(snippet, *args)
+  def gitlab_snippet_notes_url(snippet, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.snippet_notes_url(snippet, *new_args)
+    snippet_notes_url(snippet, *new_args)
   end
-  def snippet_note_path(snippet, note, *args)
+  def gitlab_snippet_note_path(snippet, note, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.snippet_note_path(snippet, note, *new_args)
+    snippet_note_path(snippet, note, *new_args)
   end
-  def snippet_note_url(snippet, note, *args)
+  def gitlab_snippet_note_url(snippet, note, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.snippet_note_url(snippet, note, *new_args)
+    snippet_note_url(snippet, note, *new_args)
   end
-  def toggle_award_emoji_snippet_note_path(snippet, note, *args)
+  def gitlab_toggle_award_emoji_snippet_note_path(snippet, note, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.toggle_award_emoji_snippet_note_path(snippet, note, *new_args)
+    toggle_award_emoji_snippet_note_path(snippet, note, *new_args)
   end
-  def toggle_award_emoji_snippet_note_url(snippet, note, *args)
+  def gitlab_toggle_award_emoji_snippet_note_url(snippet, note, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.toggle_award_emoji_snippet_note_url(snippet, note, *new_args)
+    toggle_award_emoji_snippet_note_url(snippet, note, *new_args)
   end
-  def toggle_award_emoji_snippet_path(snippet, *args)
+  def gitlab_toggle_award_emoji_snippet_path(snippet, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.toggle_award_emoji_snippet_path(snippet, *new_args)
+    toggle_award_emoji_snippet_path(snippet, *new_args)
   end
-  def toggle_award_emoji_snippet_url(snippet, *args)
+  def gitlab_toggle_award_emoji_snippet_url(snippet, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.toggle_award_emoji_snippet_url(snippet, *new_args)
+    toggle_award_emoji_snippet_url(snippet, *new_args)
   end
   private
-  def application_url_helpers
-    Gitlab::Routing.url_helpers
-  end
-
   def snippet_query_params(snippet, *args)
     opts = case args.last
            when Hash

app/helpers/issuables_helper.rb

@@ -279,19 +279,30 @@ module IssuablesHelper
       initialDescriptionText: issuable.description,
       initialTaskStatus: issuable.task_status
     }
-    data[:hasClosingMergeRequest] = issuable.merge_requests_count(current_user) != 0 if issuable.is_a?(Issue)
-    data[:zoomMeetingUrl] = ZoomMeeting.canonical_meeting_url(issuable) if issuable.is_a?(Issue)
-    if parent.is_a?(Group)
-      data[:groupPath] = parent.path
-    else
-      data.merge!(projectPath: ref_project.path, projectNamespace: ref_project.namespace.full_path)
-    end
-    data.merge!(updated_at_by(issuable))
-    data
+    data.merge!(issue_only_initial_data(issuable))
+    data.merge!(path_data(parent))
+    data.merge!(updated_at_by(issuable))
+    data
+  end
+  def issue_only_initial_data(issuable)
+    return {} unless issuable.is_a?(Issue)
+    {
+      hasClosingMergeRequest: issuable.merge_requests_count(current_user) != 0,
+      zoomMeetingUrl: ZoomMeeting.canonical_meeting_url(issuable),
+      sentryIssueIdentifier: SentryIssue.find_by(issue: issuable)&.sentry_issue_identifier # rubocop:disable CodeReuse/ActiveRecord
+    }
+  end
+  def path_data(parent)
+    return { groupPath: parent.path } if parent.is_a?(Group)
+
+    {
+        projectPath: ref_project.path,
+        projectNamespace: ref_project.namespace.full_path
+    }
   end
   def updated_at_by(issuable)

app/helpers/notes_helper.rb

@@ -95,7 +95,7 @@ module NotesHelper
   def notes_url(params = {})
     if @snippet.is_a?(PersonalSnippet)
-      snippet_notes_path(@snippet, params)
+      gitlab_snippet_notes_path(@snippet, params)
     else
       params.merge!(target_id: @noteable.id, target_type: @noteable.class.name.underscore)
@@ -105,7 +105,7 @@ module NotesHelper
   def note_url(note, project = @project)
     if note.noteable.is_a?(PersonalSnippet)
-      snippet_note_path(note.noteable, note)
+      gitlab_snippet_note_path(note.noteable, note)
     else
       project_note_path(project, note)
     end
@@ -126,7 +126,7 @@ module NotesHelper
   def new_form_url
     return unless @snippet.is_a?(PersonalSnippet)
-    snippet_notes_path(@snippet)
+    gitlab_snippet_notes_path(@snippet)
   end
   def can_create_note?

app/helpers/snippets_helper.rb

@@ -13,7 +13,7 @@ module SnippetsHelper
   def download_raw_snippet_button(snippet)
     link_to(icon('download'),
-            raw_snippet_path(snippet, inline: false),
+            gitlab_raw_snippet_path(snippet, inline: false),
             target: '_blank',
             rel: 'noopener noreferrer',
             class: "btn btn-sm has-tooltip",
@@ -109,7 +109,7 @@ module SnippetsHelper
   end
   def snippet_embed_tag(snippet)
-    content_tag(:script, nil, src: snippet_url(snippet, format: :js))
+    content_tag(:script, nil, src: gitlab_snippet_url(snippet, format: :js))
   end
   def snippet_badge(snippet)
@@ -134,7 +134,7 @@ module SnippetsHelper
     return if blob.empty? || blob.binary? || blob.stored_externally?
     link_to(external_snippet_icon('doc-code'),
-            raw_snippet_url(@snippet),
+            gitlab_raw_snippet_url(@snippet),
             class: 'btn',
             target: '_blank',
             rel: 'noopener noreferrer',
@@ -143,7 +143,7 @@ module SnippetsHelper
   def embedded_snippet_download_button
     link_to(external_snippet_icon('download'),
-            raw_snippet_url(@snippet, inline: false),
+            gitlab_raw_snippet_url(@snippet, inline: false),
             class: 'btn',
             target: '_blank',
             title: 'Download',

app/mailers/emails/notes.rb

@@ -38,7 +38,7 @@ module Emails
       setup_note_mail(note_id, recipient_id)
       @snippet = @note.noteable
-      @target_url = snippet_url(@note.noteable)
+      @target_url = gitlab_snippet_url(@note.noteable)
       mail_answer_note_thread(@snippet, @note, note_thread_options(recipient_id, reason))
     end

app/services/groups/transfer_service.rb

@@ -39,9 +39,15 @@ module Groups
         ensure_ownership
       end
+      post_update_hooks(@updated_project_ids)
+
       true
     end
+    # Overridden in EE
+    def post_update_hooks(updated_project_ids)
+    end
+
     def ensure_allowed_transfer
       raise_transfer_error(:group_is_already_root) if group_is_already_root?
       raise_transfer_error(:same_parent_as_current) if same_parent?
@@ -96,9 +102,16 @@ module Groups
         .where(id: descendants.select(:id))
         .update_all(visibility_level: @new_parent_group.visibility_level)
-      @group
+      projects_to_update = @group
         .all_projects
         .where("visibility_level > ?", @new_parent_group.visibility_level)
+
+      # Used in post_update_hooks in EE. Must use pluck (and not select)
+      # here as after we perform the update below we won't be able to find
+      # these records again.
+      @updated_project_ids = projects_to_update.pluck(:id)
+
+      projects_to_update
         .update_all(visibility_level: @new_parent_group.visibility_level)
     end
     # rubocop: enable CodeReuse/ActiveRecord

app/views/projects/tree/_readme.html.haml

 - if readme.rich_viewer
   %article.file-holder.readme-holder{ id: 'readme', class: [("limited-width-container" unless fluid_layout), ("js-show-on-root" if vue_file_list_enabled?)] }
-    .js-file-title.file-title
-      = blob_icon readme.mode, readme.name
-      = link_to project_blob_path(@project, tree_join(@ref, readme.path)) do
-        %strong
-          = readme.name
+    .js-file-title.file-title-flex-parent
+      .file-header-content
+        = blob_icon readme.mode, readme.name
+        = link_to project_blob_path(@project, tree_join(@ref, readme.path)) do
+          %strong
+            = readme.name
     = render 'projects/blob/viewer', viewer: readme.rich_viewer, viewer_url: project_blob_path(@project, tree_join(@ref, readme.path), viewer: :rich, format: :json)

app/views/search/results/_snippet_blob.html.haml

 - snippet_blob = chunk_snippet(snippet_blob, @search_term)
 - snippet = snippet_blob[:snippet_object]
 - snippet_chunks = snippet_blob[:snippet_chunks]
-- snippet_path = snippet_path(snippet)
+- snippet_path = gitlab_snippet_path(snippet)
 .search-result-row
   %span

app/views/search/results/_snippet_title.html.haml

 .search-result-row
   %h4.snippet-title.term
-    = link_to snippet_path(snippet_title) do
+    = link_to gitlab_snippet_path(snippet_title) do
       = truncate(snippet_title.title, length: 60)
       = snippet_badge(snippet_title)
     %span.cgray.monospace.tiny.float-right.term

app/views/shared/snippets/_snippet.html.haml

@@ -5,7 +5,7 @@
   = image_tag avatar_icon_for_user(snippet.author), class: "avatar s40 d-none d-sm-block", alt: ''
   .title
-    = link_to snippet_path(snippet) do
+    = link_to gitlab_snippet_path(snippet) do
       = snippet.title
     - if snippet.file_name.present?
       %span.snippet-filename.d-none.d-sm-inline-block.ml-2
@@ -14,7 +14,7 @@
     %ul.controls
       %li
-        = link_to snippet_path(snippet, anchor: 'notes'), class: ('no-comments' if notes_count.zero?) do
+        = link_to gitlab_snippet_path(snippet, anchor: 'notes'), class: ('no-comments' if notes_count.zero?) do
           = icon('comments')
           = notes_count
       %li

app/views/snippets/_actions.html.haml

@@ -5,7 +5,7 @@
     = link_to edit_snippet_path(@snippet), class: "btn btn-grouped" do
       = _("Edit")
   - if can?(current_user, :admin_personal_snippet, @snippet)
-    = link_to snippet_path(@snippet), method: :delete, data: { confirm: _("Are you sure?") }, class: "btn btn-grouped btn-inverted btn-remove", title: _('Delete Snippet') do
+    = link_to gitlab_snippet_path(@snippet), method: :delete, data: { confirm: _("Are you sure?") }, class: "btn btn-grouped btn-inverted btn-remove", title: _('Delete Snippet') do
       = _("Delete")
   - if can?(current_user, :create_personal_snippet)
     = link_to new_snippet_path, class: "btn btn-grouped btn-success btn-inverted", title: _("New snippet") do
@@ -24,7 +24,7 @@
             = _("New snippet")
       - if can?(current_user, :admin_personal_snippet, @snippet)
         %li
-          = link_to snippet_path(@snippet), method: :delete, data: { confirm: _("Are you sure?") }, title: _('Delete Snippet') do
+          = link_to gitlab_snippet_path(@snippet), method: :delete, data: { confirm: _("Are you sure?") }, title: _('Delete Snippet') do
             = _("Delete")
       - if can?(current_user, :update_personal_snippet, @snippet)
         %li

app/views/snippets/edit.html.haml

@@ -3,4 +3,4 @@
 %h3.page-title
   = _("Edit Snippet")
 %hr
-= render 'shared/snippets/form', url: snippet_path(@snippet)
+= render 'shared/snippets/form', url: gitlab_snippet_path(@snippet)

changelogs/unreleased/27025-add-border-top-in-readme.yml

+---
+title: Fix top border of README file header in file list
+merge_request: 21314
+author:
+type: fixed

changelogs/unreleased/fj-fix-snippets-routes.yml

+---
+title: Rename snippet refactored routes
+merge_request: 21267
+author:
+type: fixed

changelogs/unreleased/security-400-path-traversal-rce2.yml

+---
+title: Update maven_file_name_regex for full string match
+merge_request:
+author:
+type: security

lib/gitlab/url_builder.rb

@@ -25,7 +25,7 @@ module Gitlab
       when WikiPage
         wiki_page_url
       when Snippet
-        opts[:raw].present? ? raw_snippet_url(object) : snippet_url(object)
+        opts[:raw].present? ? gitlab_raw_snippet_url(object) : gitlab_snippet_url(object)
       when Milestone
         milestone_url(object)
       when ::Ci::Build
@@ -65,7 +65,7 @@ module Gitlab
         merge_request_url(object.noteable, anchor: dom_id(object))
       elsif object.for_snippet?
-        snippet_url(object.noteable, anchor: dom_id(object))
+        gitlab_snippet_url(object.noteable, anchor: dom_id(object))
       end
     end