[merge-train skip]

[ci skip]

[ci skip]

Cherry-pick danger fixes into 15.11

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/127680



Merged-by: Steve Abrams <sabrams@gitlab.com>
Approved-by: Steve Abrams <sabrams@gitlab.com>
Co-authored-by: Lin Jen-Shin <jen-shin@gitlab.com>
Co-authored-by: Jennifer Li <jli@gitlab.com>

Mayra Cabrera authored 1 year ago and Steve Abrams committed 1 year ago

Adjust stable branch logic for package-and-test

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/118668



Merged-by: Jennifer Li <jli@gitlab.com>
Approved-by: Steve Abrams <sabrams@gitlab.com>
Approved-by: Jennifer Li <jli@gitlab.com>
Reviewed-by: Mayra Cabrera <mcabrera@gitlab.com>
Reviewed-by: Steve Abrams <sabrams@gitlab.com>
Co-authored-by: Mayra Cabrera <mcabrera@gitlab.com>

Disable IAT verification by default

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/127520



Merged-by: Steve Abrams <sabrams@gitlab.com>
Approved-by: Drew Blessing <drew@gitlab.com>
Approved-by: Andrejs Cunskis <acunskis@gitlab.com>
Approved-by: Steve Abrams <sabrams@gitlab.com>
Reviewed-by: Mayra Cabrera <mcabrera@gitlab.com>
Co-authored-by: Stan Hu <stanhu@gmail.com>

https://gitlab.com/gitlab-org/gitlab/-/merge_requests/117468 in GitLab
15.11 updated the ruby-jwt gem to v2.5.0. In v2.2.0, ruby-jwt removed
the `iat_leeway` parameter (https://github.com/jwt/ruby-jwt/pull/274).

As a result, if a gitlab-shell host creates a JWT token with an
issued-at (IAT) claim that is slightly behind the host handling API
the request, users will receive a 401 error.

Disable this IAT verification by default since it's not serving a
useful purpose, since expiration times are already validated. We
already made a similar change in Geo.

Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/417543

Changelog: fixed

[merge-train skip]

[ci skip]

[ci skip]

[merge-train skip]

[ci skip]

[ci skip]

Add authorization to the subscriptions group controller

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3381



Merged-by: Mayra Cabrera <mcabrera@gitlab.com>
Approved-by: Doug Stull <dstull@gitlab.com>
Approved-by: Thong Kuah <tkuah@gitlab.com>
Co-authored-by: Doug Stull <dstull@gitlab.com>

Ryan Cobb authored 1 year ago and Mayra Cabrera committed 1 year ago

Merge branch 'security-416797-fix-auth-issue-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3381

Changelog: security

[merge-train skip]

[ci skip]

[ci skip]

Revert 'security-leaked-ci-job-token-permission-15-11' from '15-11'"

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3375



Merged-by: John Skarbek <jskarbek@gitlab.com>
Approved-by: Dominic Couture <dcouture@gitlab.com>
Approved-by: A Browne <abrowne@gitlab.com>
Co-authored-by: Max Fan <mfan@gitlab.com>

Max Fan authored 1 year ago and John Skarbek committed 1 year ago

Merge branch 'revert-822d17d7' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3375

Changelog: security

Use fully qualified ref when loading code owner file

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3354



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Vasilii Iakliushin <viakliushin@gitlab.com>
Co-authored-by: Joe Woodward <jwoodward@gitlab.com>

Joe Woodward authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-410123-bypass-code-owner-approvals-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3354

Changelog: security

Maintainer can leak masked webhook secrets by manipulating URL masking

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3361



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Luke Duncalfe <lduncalfe@gitlab.com>
Co-authored-by: bmarjanovic <bmarjanovic@gitlab.com>

Bojan Marjanović authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-410433-confidential-issue-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3361

Changelog: security

Remove approvals when the only commit gets amended

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3368



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Patrick Bajao <ebajao@gitlab.com>
Co-authored-by: David Kim <dkim@gitlab.com>

David Kim authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-fix-907-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3368

Changelog: security

Fix for fork permissions check in compare controller

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3344



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Vasilii Iakliushin <viakliushin@gitlab.com>
Co-authored-by: Robert May <rmay@gitlab.com>

Robert May authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-408137-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3344

Changelog: security

Webhook token leaked in Sidekiq logs if log format is 'default'

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3347



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Roy Zwambag <rzwambag@gitlab.com>
Co-authored-by: bmarjanovic <bmarjanovic@gitlab.com>

Bojan Marjanović authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-409034-confidential-issue-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3347

Changelog: security

Mitigate epic reference filter ReDOS

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3339



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Vitali Tatarintev <vtatarintev@gitlab.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Brett Walker authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-untrusted-epic-reference-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3339

Changelog: security

Increasing security for CI_JOB_TOKEN on public and internal projects

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3319



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: A Browne <abrowne@gitlab.com>
Co-authored-by: Max Fan <mfan@gitlab.com>

Max Fan authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-leaked-ci-job-token-permission-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3319

Changelog: security

Merge branch 'security-dblessing_fix_html_injection_admin_unconfirmed_user-15-11' into '15-11-stable-ee'

Sanitize user email addresses in admin confirm user dialog

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3332



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Kassio Borges <kborges@gitlab.com>
Co-authored-by: Drew Blessing <drew@gitlab.com>

Drew Blessing authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-dblessing_fix_html_injection_admin_unconfirmed_user-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3332

Changelog: security

Obfuscate email of service desk issue creator in issue REST API

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3316



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Mario Celi <mcelicalderon@gitlab.com>
Co-authored-by: Peter Leitzen <pleitzen@gitlab.com>

Peter Leitzen authored 1 year ago and GitLab Release Tools Bot committed 1 year ago

Merge branch 'security-service-desk-obfuscate-email-api-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3316

Changelog: security