Add method to store session ids by ip

Add new specs for storing session ids

Add cleaning up records after login

Add retrieving anonymous sessions

Add login recaptcha setting

Add new setting to sessions controller

Add conditions for showing captcha

Add sessions controller specs

Add admin settings specs for login protection

Add new settings to api

Add stub to devise spec

Add new translation key

Add cr remarks

Rename class call

Add cr remarks

Change if-clause for consistency

Add cr remarks

Add code review remarks

Refactor AnonymousSession class

Add changelog entry

Move AnonymousSession class to lib

Move store unauthenticated sessions to sessions controller

Move link to recaptcha info

Regenerate text file

Improve copy on the spam page

Change action filter for storing anonymous sessions

Fix rubocop offences

Add code review remarks

Fix specs

Update schema version

Use image proxy to mitigate stealing ip addresses

See merge request gitlab/gitlabhq!3192

Queries for Upload should be scoped by model

See merge request gitlab/gitlabhq!3233

Filter out old system notes for epics in notes api endpoint response

See merge request gitlab/gitlabhq!3242

Fix HTML injection for label description

See merge request gitlab/gitlabhq!3256

Limit the size of issuable description and comments

See merge request gitlab/gitlabhq!3272

Permission fix for MergeRequestsController#pipeline_status

See merge request gitlab/gitlabhq!3279

Enforce max chars and max render time in markdown math

See merge request gitlab/gitlabhq!3288

DNS Rebind SSRF in Kubernetes Integration

See merge request gitlab/gitlabhq!3290

Ensure only authorised users can create notes on merge requests and issues

See merge request gitlab/gitlabhq!3308

Fix DNS rebind vulnerability for JIRA integration

See merge request gitlab/gitlabhq!3312

Add merge note type as cross reference

See merge request gitlab/gitlabhq!3326

Project visibility restriction bypass

See merge request gitlab/gitlabhq!3332

Bump Gitaly version to 1.47.3

See merge request gitlab/gitlabhq!3335

Introduce JobActivity limit for alive jobs

See merge request gitlab/gitlabhq!3341

Clear reset_password_tokens when login (email or username) change

See merge request gitlab/gitlabhq!3348

Restrict MergeRequests#test_reports to authenticated users with read-access on Builds

See merge request gitlab/gitlabhq!3356

Add direct upload support for personal snippets

See merge request gitlab/gitlabhq!3357

admin_group authorization for Groups::RunnersController

See merge request gitlab/gitlabhq!3364

Re-escape the whole HTML content when finding HTML references

See merge request gitlab/gitlabhq!3369

When we un-escape HTML text to find references in it, we should then
re-escape the whole text again, not only found matches.

Because we replace matches with milestone/label links (which contain
HTML tags we don't want to escape again), we re-escape HTML text
with placeholders instead of these links and then replace placeholders
in the escaped text.

- Use authorize_admin_group! instead of authorize_admin_pipeline!
- Added role-based permission specs for Groups::RunnersController

Limiting the size of issuable description and comments to 1_000_000,
which is close to ~1MB of ASCII characters, which represents 99.9% of
all descriptions and comments we have in DB at the moment. This should
help prevent DoS attacks when comments contain refference strings.

Also this change updates regexp matching the namespaces paths by
limiting the namespaces paths to Namespace::NUMBER_OF_ANCESTORS_ALLOWED,
as we allow 20 levels deep groups.

see https://gitlab.com/gitlab-org/gitlab-ce/issues/61974#note_191274234

Devise checks before updating any of the authentication_keys if it
needs to clear the reset_password_tokens.

This should fix:
https://gitlab.com/gitlab-org/gitlab-ce/issues/42733 (Weak
authentication and session management)

This is a port from EE changes where
we introduce a new limit for Plan model.

https://dev.gitlab.org/gitlab/gitlab-ee/merge_requests/1182

Updates changelog to reflect appropriate release versions

See merge request gitlab/gitlabhq!3321

User images and videos will get proxied through
the Camo server in order to keep malicious
sites from collecting the IP address of users.

Add Gitlab::VisibilityLevelChecker that verifies
selected project visibility level (or overridden param)
is not restricted when creating or importing a project

- Use set_pipeline_variables to filter for visible pipelines
- Mimic response of nonexistent pipeline if not found
- Provide set_pipeline_variables as a before_filter for other actions

[ci skip]

[ci skip]

Update Gitaly to v1.47.2 for security fix

See merge request gitlab/gitlabhq!3300