[merge-train skip]

[ci skip]

[ci skip]

Merge branch 'security-518-fix-change-project-visibility-to-restricted-option-14-2' into '14-2-stable-ee'

Change project visibility to a restricted option

See merge request gitlab-org/security/gitlab!1905

Highlight usage of unicode bidi characters

See merge request gitlab-org/security/gitlab!1939

SCIM token is still Viewable After Creation

See merge request gitlab-org/security/gitlab!1908

Redact list of groups a project is shared with

See merge request gitlab-org/security/gitlab!1799

Fix path traversal issue with SVG hrefs

See merge request gitlab-org/security/gitlab!1931

Avoid decoding the whole tiff image on isTIFF check

See merge request gitlab-org/security/gitlab!1901

Workhorse: Allow uploading only a single file

See merge request gitlab-org/security/gitlab!1915

Do not allow Applications API to create apps with blank scopes

See merge request gitlab-org/security/gitlab!1924

Refresh authorizations on transfer of groups having project shares

See merge request gitlab-org/security/gitlab!1918

Don't allow author to resolve discussions when MR is locked via GraphQL

See merge request gitlab-org/security/gitlab!1921

Never display the root password

See merge request gitlab-org/security/gitlab!1802

Iterate over trailing space regex replacements

See merge request gitlab-org/security/gitlab!1898

Prevent private e-mail from being shown in webhook data

See merge request gitlab-org/security/gitlab!1895

Match with verified_email? rather than any_email?[RUN ALL RSPEC] [RUN AS-IF-FOSS]

See merge request gitlab-org/security/gitlab!1883

Disallow guests to change severity on incidents

See merge request gitlab-org/security/gitlab!1876

Set imported PipelineSchedules to inactive

See merge request gitlab-org/security/gitlab!1878

Remove external_webhook_token from exported project

See merge request gitlab-org/security/gitlab!1865

Adds markup around unicode bidi characters when highlighting
code. These are used primarily for text direction in
right-to-left languages, but can be used as an exploit.

Changelog: security

This fixes an issue with SVGs href sanitization
which was bypassable using path traversal

Changelog: security

This change makes sure that when a group that
has any project-group shares is transferred,
it refresh authorizations of projects that are
shared to the group.

Changelog: security

This change makes sure that the using the
Applications API, admins cannot create
an app with a “blank” scope. At least one scope
should be explicitly specified in the params while
making the “POST” request to create an application.

Changelog: security

Merge branch 'sarnold-qurantine-flakey-rotation-dst-specs' into '14-2-stable-ee'

See merge request gitlab-org/gitlab!72772

Quarantine flaky DST specs

See merge request gitlab-org/gitlab!72748

(cherry picked from commit a0d10fed)

a1f862dd Quarantine flaky DST spec
ac843eeb Apply 1 suggestion(s) to 1 file(s)

We don't allow non-project members to resolve discussions via UI
but the discussionToggleResolve GraphQL mutation allows it.

This fixes it by modifying `ResolvableDiscussions#can_resolve?` to
call appropriate policy check.

Changelog: security

Gitlab Rails doesn't have endpoints that require uploading
multiple files.

Let's limit it to prevent performance issues and proceed with
a proper solution out of Security Release

Changelog: security

Even group owners should see SCIM token only once after creation.
There is an option to reset the token in case it was lost or
forgotten

Changelog: security
EE: true

When updating project or group visibility settings
we must respect instance level visibility restrictions.

Changelog: security

Changelog: security

Changelog: security

Use chomp for path trimming

Minor refactor chomped calls into a loop
and fixes a rubocop lint.

Add PATH_TRAILING_VIOLATIONS constant

Making public_email = email a trait for a factory

This also fixes some specs that were relying on private email in
the user's `hook_attrs`

Changelog: security

Defaults display_initial_root_password config setting to `false`.

The root password can be retrieved with `kubectl get secret` in a
production setting (see:
https://docs.gitlab.com/charts/installation/deployment.html#initial-login)

Changelog: security

Matching against any_email? potentially allows users to avoid required
code ownership rules by adding a code owner's email address that to
their own as a secondary email address.

Changelog: fixed
EE: true

Cleanup typos in comments (thanks @Vij)

Set imported Ci::PipelineSchedules to inactive.

Changelog: security

[merge-train skip]