[merge-train skip]

[ci skip]

[ci skip]

Prepare 14.3.5-ee release

See merge request gitlab-org/gitlab!75145

Fix 2FA e2e tests by setting user password

See merge request gitlab-org/gitlab!71528

(cherry picked from commit edd83af0)

04565a60 Set user password when enabling 2FA

Mark Lapierre authored 3 years ago and Sofia Vistas committed 3 years ago

Fix registry related tests

See merge request gitlab-org/gitlab!73825

Mark Lapierre authored 3 years ago and Sofia Vistas committed 3 years ago

Add container registry to object storage

See merge request gitlab-org/gitlab!71905

John Skarbek authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74706

Changelog: fixed
EE: true

Michael Kozono authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74133

Changelog: fixed
EE: true

Douglas Barbosa Alexandre authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/73952

Changelog: fixed
EE: true

Douglas Barbosa Alexandre authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/72925

Changelog: fixed

Jacques Erasmus authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/72492

Changelog: fixed

Allow SSO callbacks through maintenance mode

See merge request gitlab-org/gitlab!74706

When using other authentication methods, like SSO, LDAP,
the path and controllers are slightly different, as they
redirect back to a callback handled by Omniauth.

This adds the specific routes and controller to the allowlist
in the read-only middleware to allow them to go through.

Changelog: fixed
EE: true

[merge-train skip]

[ci skip]

[ci skip]

Merge branch 'security-518-fix-change-project-visibility-to-restricted-option-14-3' into '14-3-stable-ee'

Change project visibility to a restricted option

See merge request gitlab-org/security/gitlab!1904

Highlight usage of unicode bidi characters

See merge request gitlab-org/security/gitlab!1938

SCIM token is still Viewable After Creation

See merge request gitlab-org/security/gitlab!1907

Redact list of groups a project is shared with

See merge request gitlab-org/security/gitlab!1798

Fix path traversal issue with SVG hrefs

See merge request gitlab-org/security/gitlab!1930

Avoid decoding the whole tiff image on isTIFF check

See merge request gitlab-org/security/gitlab!1900

Workhorse: Allow uploading only a single file

See merge request gitlab-org/security/gitlab!1914

Do not allow Applications API to create apps with blank scopes

See merge request gitlab-org/security/gitlab!1923

Refresh authorizations on transfer of groups having project shares

See merge request gitlab-org/security/gitlab!1917

Don't allow author to resolve discussions when MR is locked via GraphQL

See merge request gitlab-org/security/gitlab!1920

Never display the root password

See merge request gitlab-org/security/gitlab!1803

Iterate over trailing space regex replacements

See merge request gitlab-org/security/gitlab!1897

Prevent private e-mail from being shown in webhook data

See merge request gitlab-org/security/gitlab!1894

Match with verified_email? rather than any_email?[RUN ALL RSPEC] [RUN AS-IF-FOSS]

See merge request gitlab-org/security/gitlab!1882

Disallow guests to change severity on incidents

See merge request gitlab-org/security/gitlab!1875

Set imported PipelineSchedules to inactive

See merge request gitlab-org/security/gitlab!1879

Remove external_webhook_token from exported project

See merge request gitlab-org/security/gitlab!1866

Adds markup around unicode bidi characters when highlighting
code. These are used primarily for text direction in
right-to-left languages, but can be used as an exploit.

Changelog: security

This fixes an issue with SVGs href sanitization
which was bypassable using path traversal

Changelog: security

This change makes sure that when a group that
has any project-group shares is transferred,
it refresh authorizations of projects that are
shared to the group.

Changelog: security