DJ Mountney authored 5 years ago and Imre (Admin) committed 5 years ago

This prevents an issue where you can steal other projects objects by
asking for ids that don't belong to you in import.

When referencing cross-namespace labels, we append the namespace name
to the rendered label.

This MR escapes the name to prevent XSS attacks.

- if the user has access level lower than REPORTER,
don't include commit count in summary

- List all overly-recursive fields
- Reduce recursion threshold to 2
- Add test for not-recursive-enough query
- Use reusable methods in tests
- Add changelog
- Set changeable acceptable recursion level
- Add error check test helpers

Previously, when the wiki page format was anything other than `markdown`
or `asciidoc` the formatted content would be returned though a Gitaly
call. Gitaly in turn would delegate formatting to the gitlab-gollum-lib
gem, which in turn would delegate that to various gems (like RDoc for
`rdoc`) and then apply some very liberal sanitization.

It was too liberal!

This change brings our wiki content formatting in line with how we
format other markdown at GitLab, so we have a SSOT for sanitization.

https://gitlab.com/gitlab-org/gitlab/issues/30540

Use project scopes to filter project labels that are visible for user

Label events may use cross-project or cross-group references,
if the projects are not accessible by user, we don't show these
label events.

If the request wasn't initiated by gitlab we shouldn't add the new
identity to the user, and instead show that we weren't able to link
the identity to the user.

This should fix: https://gitlab.com/gitlab-org/gitlab-ce/issues/56509

Reuben Pereira authored 5 years ago and Andreas Brandl committed 5 years ago

- A regular migration caused problems such as
https://gitlab.com/charts/gitlab/issues/1565.

Adam Hegyi authored 5 years ago and Peter Leitzen committed 5 years ago

This change sets up a usage counter for productivity analytics feature.