[merge-train skip]

[ci skip]

[ci skip]

Don't allow to add users to project with email different than group sett

See merge request gitlab-org/security/gitlab!1562

Merge branch 'security-nfriend-hide-project-ci-cd-analytics-for-guests-13-12' into '13-12-stable-ee'

Hide project-level CI/CD Analytics page for Guest users

See merge request gitlab-org/security/gitlab!1575

Merge branch 'security-not-allow-to-impersonate-tokens-while-impersonation-is-off-13-12' into '13-12-stable-ee'

Block pushing with impersonation token if impersonation is disabled

See merge request gitlab-org/security/gitlab!1585

Changelog: security

Changelog: security

This commit updates the project-level CI/CD Analytics page to not be
accessible by Guest users of private projects.

Changelog: security

Add permissions check to pipelines#show action

See merge request gitlab-org/security/gitlab!1618

Do not show email address in error message

See merge request gitlab-org/security/gitlab!1598

Misleading username could lead to impersonation in using SSH Certificates

See merge request gitlab-org/security/gitlab!1611

Remove impersonation token from api response for non-admin user

See merge request gitlab-org/security/gitlab!1567

Only allow invite to be accepted by user with matching email

See merge request gitlab-org/security/gitlab!1634

Configure OmniAuth to use GitLab AppLogger

See merge request gitlab-org/security/gitlab!1617

Merge branch 'security-prevent-guests-from-creating-issues-with-sentry-error-13-12' into '13-12-stable-ee'

Prevent Guest users from creating issues linked to Sentry errors

See merge request gitlab-org/security/gitlab!1599

Updates oauth to 0.5.6

See merge request gitlab-org/security/gitlab!1569

Unauthorized User Can Trigger Deployment to the Protected Environment

See merge request gitlab-org/security/gitlab!1608

Fix tag ref detection for pipelines

See merge request gitlab-org/security/gitlab!1549

Restrict access to instance-level security features for reporters

See merge request gitlab-org/security/gitlab!1540

[13.12] Fix XSS in Mermaid Markdown rendering

See merge request gitlab-org/security/gitlab!1487

Filter todos whose target users no longer have access to [RUN AS-IF-FOSS]

See merge request gitlab-org/security/gitlab!1555

Previously, any user was able to accept an invite even if the
user's email addresses didn't match the invite. A note was
displayed but the invite could still be accepted. With this
change, a user without a matching, confirmed email address
is unable to accept the invite.

Changelog: security

OmniAuth logger was not being configured properly and some logs
were being dropped. This change ensures OmniAuth log messages
are output to `application.log` and/or `application_json.log`
as appropriate depending on configuration.

Changelog: security

Fix Group SAML Spec order dependency

Change `allow/expect_any_instance_of` to
`allow/expect_next_instance_of` to avoid leaking state from other
tests.

Changelog: security

Protected Environment Accesses were not automatically cleaned up
when a user was removed from the project membership.
Also, the leftover user/group entry in the access list
couldn't be removed manually.

This commit fixes these security related bugs.

Changelog: security
EE: true

This check renders a 404 in case the user trying
to access the pipeline details page doesn't have enough
permissions

Changelog: security

Jose Ivan Vargas Lopez authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Disable browserslist warning in CI jobs

See merge request gitlab-org/gitlab!66942

(cherry picked from commit 89dec6ec)

61c4eacf Disable browserslist warning in CI jobs

Updates the gitlab-shell version to include a security patch.

Changelog: security

Changelog: security

Changelog: security
EE: true

Changelog: security

Changelog: security

The DB might contain todos for targets a user no longer has access to.
As target is exposed via the REST API and Rails app, this change filters
out todos the user no longer has access to.

Changelog: security

[merge-train skip]

[ci skip]

[ci skip]

Alexis Kalderimis authored 3 years ago and Mayra Cabrera committed 3 years ago

Quarantine failing group board spec

See merge request gitlab-org/gitlab!64809

Disable filesystem and network premailer strategies

See merge request gitlab-org/security/gitlab!1545