[ci skip]

Support object storage at FileMover class

See merge request gitlab/gitlabhq!3197

[ci skip]

Ability to write a note in a private snippet

See merge request gitlab/gitlabhq!3140

Prevent Billion Laughs attack

See merge request gitlab/gitlabhq!3145

Guests can know whether merge request template name exists or not

See merge request gitlab/gitlabhq!3150

Fix MR head pipeline leak

See merge request gitlab/gitlabhq!3156

Fix DOS when rendering issue/MR comments

See merge request gitlab/gitlabhq!3159

Persist tmp snippet uploads at users

See merge request gitlab/gitlabhq!3166

Expose merge requests count based on user access

See merge request gitlab/gitlabhq!3169

Fix type authorizations in GraphQL

See merge request gitlab/gitlabhq!3174

Fix color validation regex causing DoS

See merge request gitlab/gitlabhq!3178

Disable Rails SQL query cache when applying service templates

See merge request gitlab/gitlabhq!3181

[ci skip]

Prepare 11.10.7 release

See merge request gitlab-org/gitlab-ce!30067

Fatih Acet authored 5 years ago and GitLab Release Tools Bot committed 5 years ago

Fix gl_dropdown scrolling to top on assignee click

See merge request gitlab-org/gitlab-ce!29500

(cherry picked from commit 2a29f910)

3130572f Fix gl_dropdown scrolling to top on assignee click

Fatih Acet authored 5 years ago and GitLab Release Tools Bot committed 5 years ago

Fix label click scrolling to top

Closes #61246

See merge request gitlab-org/gitlab-ce!29202

(cherry picked from commit 92b06c13)

c9c7fa7b Fix label click scrolling to top

Kamil Trzcińśki authored 5 years ago and GitLab Release Tools Bot committed 5 years ago

Revert a default GIT_DEPTH for MR pipeline

See merge request gitlab-org/gitlab-ce!28926

(cherry picked from commit 765917dc)

dbd62232 Revert a default GIT_DEPTH for MR pipeline

Add client code to call GetObjectDirectorySize RPC

See merge request gitlab-org/gitlab-ce!29843

When the SQL query cache is active, the SELECT query for finding
projects to apply service templates returns the same values. This causes
an infinite loop because even though bulk INSERT queries are made, the
cached results never reflect that progress.  To fix this, we call
`Project.uncached` around the query to ensure new data is retrieved.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/63595

This includes the changes for GITALY_SERVER_VERSION and Gemfile

Also prevents ReDoS vulnerability

0. Add authorize to LabelType and NamespaceType.

1. Make sure that authorizations on non-nullable fields are also
executed.

Francisco Javier López authored 5 years ago and Alexandru Croitor committed 5 years ago

Removed the conditions added to
Project.with_feature_available_for_user, and moved to the
IssuableFinder. Now, we ensure that, in the projects retrieved
in the Finder, the user has enough access for the feature.

Count issues related merge requests based on user access level. And
issue can have related MRs from projects where user does not have
access so the number of related merge requests should be adjusted
based on user's ability to access the related MRs.

https://gitlab.com/gitlab-org/gitlab-ce/issues/59581

It persist temporary personal snippets under
user/:id namespaces temporarily while creating
a upload record to track it. If an user gets removed
while it's still a tmp upload, it also gets removed.
If the tmp upload is sent, the upload gets moved to
personal_snippets/:id as before. The upload record
also gets updated to the new model type as well.

Previously, if a user was a guest member of a private project, they
could access the merge request template as we were not checking
permission-levels of the user.

When a issue template is asked for, the user must have :read_issue for
the project; or :read_merge_request when a merge request template is
asked for.

We also now rescue_from FileNotFoundError and handle as 404. This is
because RepoTemplateFinder can raise a FileNotFoundError exception,
which Rails previously handled as a 500.

Handling these in a way that is consistent with
ActiveRecord::RecordNotFound exceptions, within controllers that
inherit from Projects::ApplicationController at least, and returning a
404.

https://gitlab.com/gitlab-org/gitlab-ce/issues/54943

It keeps track of the memory being used when loading the YAML file
as well as the depth of nesting.
Track exception when YAML is too big

In the Snippets::NotesController the noteable was resolved and
authorized through the :snippet_id, so by passing a :target_id for a
different snippet it was possible to create a note on a snippet
where the user would be unauthorized to do so otherwise.

This fixes the problem by ignoring the :target_id and :target_type from
the request, and using the same noteable for creation and authorization.

[ci skip]

Prepare 11.10.6 release

See merge request gitlab-org/gitlab-ce!28991

Rémy Coutable authored 5 years ago and John Jarvis committed 5 years ago

Use a path for the related merge requests endpoint

Closes #61280

See merge request gitlab-org/gitlab-ce!28171

Use source ref in pipeline webhook

Closes #61553

See merge request gitlab-org/gitlab-ce!28772

(cherry picked from commit 2714f85c)

7e05f3b7 Use source ref for pipeline webhook