[merge-train skip]

[ci skip]

[ci skip]

Merge branch 'security-518-fix-change-project-visibility-to-restricted-option-14-4' into '14-4-stable-ee'

Change project visibility to a restricted option

See merge request gitlab-org/security/gitlab!1903

Highlight usage of unicode bidi characters

See merge request gitlab-org/security/gitlab!1937

SCIM token is still Viewable After Creation

See merge request gitlab-org/security/gitlab!1906

Redact list of groups a project is shared with

See merge request gitlab-org/security/gitlab!1910

Fix path traversal issue with SVG hrefs

See merge request gitlab-org/security/gitlab!1929

Avoid decoding the whole tiff image on isTIFF check

See merge request gitlab-org/security/gitlab!1899

Workhorse: Allow uploading only a single file

See merge request gitlab-org/security/gitlab!1913

Do not allow Applications API to create apps with blank scopes

See merge request gitlab-org/security/gitlab!1922

Refresh authorizations on transfer of groups having project shares

See merge request gitlab-org/security/gitlab!1916

Don't allow author to resolve discussions when MR is locked via GraphQL

See merge request gitlab-org/security/gitlab!1919

Do not display the root password by default

See merge request gitlab-org/security/gitlab!1909

Iterate over trailing space regex replacements

See merge request gitlab-org/security/gitlab!1912

Prevent private e-mail from being shown in webhook data

See merge request gitlab-org/security/gitlab!1927

Match with verified_email? rather than any_email?

See merge request gitlab-org/security/gitlab!1926

Disallow guests to change severity on incidents

See merge request gitlab-org/security/gitlab!1902

Set imported PipelineSchedules to inactive

See merge request gitlab-org/security/gitlab!1911

Remove external_webhook_token from exported project

See merge request gitlab-org/security/gitlab!1872

Adds markup around unicode bidi characters when highlighting
code. These are used primarily for text direction in
right-to-left languages, but can be used as an exploit.

Changelog: security

This fixes an issue with SVGs href sanitization
which was bypassable using path traversal

Changelog: security

This change makes sure that when a group that
has any project-group shares is transferred,
it refresh authorizations of projects that are
shared to the group.

Changelog: security

[merge-train skip]

[ci skip]

[ci skip]

[merge-train skip]

[merge-train skip]

Making public_email = email a trait for a factory

This also fixes some specs that were relying on private email in
the user's `hook_attrs`

Changelog: security

Matching against any_email? potentially allows users to avoid required
code ownership rules by adding a code owner's email address that to
their own as a secondary email address.

Changelog: fixed
EE: true

Cleanup typos in comments (thanks @Vij)

Changelog: security

Use chomp for path trimming

Minor refactor chomped calls into a loop
and fixes a rubocop lint.

Add PATH_TRAILING_VIOLATIONS constant

This change makes sure that the using the
Applications API, admins cannot create
an app with a “blank” scope. At least one scope
should be explicitly specified in the params while
making the “POST” request to create an application.

Changelog: security

[merge-train skip]

Merge branch 'sarnold-qurantine-flakey-rotation-dst-specs' into '14-4-stable-ee'

See merge request gitlab-org/gitlab!72767

Quarantine flaky DST specs

See merge request gitlab-org/gitlab!72748

(cherry picked from commit a0d10fed)

a1f862dd Quarantine flaky DST spec
ac843eeb Apply 1 suggestion(s) to 1 file(s)

We don't allow non-project members to resolve discussions via UI
but the discussionToggleResolve GraphQL mutation allows it.

This fixes it by modifying `ResolvableDiscussions#can_resolve?` to
call appropriate policy check.

Changelog: security

Gitlab Rails doesn't have endpoints that require uploading
multiple files.

Let's limit it to prevent performance issues and proceed with
a proper solution out of Security Release

Changelog: security

Set imported Ci::PipelineSchedules to inactive.

Changelog: security