[merge-train skip]

[ci skip]

[ci skip]

Don't allow to add users to project with email different than group sett

See merge request gitlab-org/security/gitlab!1564

Hide project-level CI/CD Analytics page for Guest users

See merge request gitlab-org/security/gitlab!1600

Merge branch 'security-not-allow-to-impersonate-tokens-while-impersonation-is-off-14-1' into '14-1-stable-ee'

Block pushing with impersonation token if impersonation is disabled

See merge request gitlab-org/security/gitlab!1583

Changelog: security

This commit updates the project-level CI/CD Analytics page to not be
accessible by Guest users of private projects.

Changelog: security

Add permissions check to pipelines#show action

See merge request gitlab-org/security/gitlab!1612

Disallow non-members to set issue metadata on issue create

See merge request gitlab-org/security/gitlab!1586

Do not show email address in error message

See merge request gitlab-org/security/gitlab!1596

Misleading username could lead to impersonation in using SSH Certificates

See merge request gitlab-org/security/gitlab!1609

Remove impersonation token from api response for non-admin user

See merge request gitlab-org/security/gitlab!1565

Only allow invite to be accepted by user with matching email

See merge request gitlab-org/security/gitlab!1632

Add html escaping for default branch name

See merge request gitlab-org/security/gitlab!1630

Configure OmniAuth to use GitLab AppLogger

See merge request gitlab-org/security/gitlab!1615

Merge branch 'security-prevent-guests-from-creating-issues-with-sentry-error-14-1' into '14-1-stable-ee'

Prevent Guest users from creating issues linked to Sentry errors

See merge request gitlab-org/security/gitlab!1587

Use oauth_app id instead of uid

See merge request gitlab-org/security/gitlab!1603

Updates oauth to 0.5.6

See merge request gitlab-org/security/gitlab!1592

Unauthorized User Can Trigger Deployment to the Protected Environment

See merge request gitlab-org/security/gitlab!1606

Fix tag ref detection for pipelines

See merge request gitlab-org/security/gitlab!1591

Restrict access to instance-level security features for reporters

See merge request gitlab-org/security/gitlab!1561

[14.1] Fix XSS in Mermaid Markdown rendering

See merge request gitlab-org/security/gitlab!1488

Filter todos whose target users no longer have access to [RUN AS-IF-FOSS]

See merge request gitlab-org/security/gitlab!1556

Previously, any user was able to accept an invite even if the
user's email addresses didn't match the invite. A note was
displayed but the invite could still be accepted. With this
change, a user without a matching, confirmed email address
is unable to accept the invite.

Changelog: security

This escapes html chars for default branch
name value in initializing repository instructions

This is to prevent XSS vulnerability

Changelog: security

[merge-train skip]

[ci skip]

[ci skip]

Prepare 14.1.1-ee release

See merge request gitlab-org/gitlab!66726

Andreas Brandl authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/66627

Changelog: other

Disable browserslist warning in CI jobs - 14.1 backport

See merge request gitlab-org/gitlab!66950

browserslist throws a warning if certain dependencies are too old. As we
generally are not backporting browserslist updates, this can lead to
errors in CI. Previously we have caught the error in rake, but they have
changed the error message so it is failing again.

By simply setting the BROWSERSLIST_IGNORE_OLD_DATA env variable, we can
circumvent this issue.

OmniAuth logger was not being configured properly and some logs
were being dropped. This change ensures OmniAuth log messages
are output to `application.log` and/or `application_json.log`
as appropriate depending on configuration.

Changelog: security

This check renders a 404 in case the user trying
to access the pipeline details page doesn't have enough
permissions

Changelog: security

Updates the gitlab-shell version to include a security patch.

Changelog: security

Protected Environment Accesses were not automatically cleaned up
when a user was removed from the project membership.
Also, the leftover user/group entry in the access list
couldn't be removed manually.

This commit fixes these security related bugs.

Changelog: security
EE: true

Fix to use oauth application internal id instead of uid

Changelog: security
EE: true

Doug Stull authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Create 14.1 What's new entry

See merge request gitlab-org/gitlab!66570

(cherry picked from commit 78e23268)

52b889bb Create 14.1 What's new entry 
e0e43721 Add registration features entry

Mayra Cabrera authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/66437

Changelog: fixed