[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Update mermaid to version 8.9.2

See merge request gitlab-org/security/gitlab!1364

Do not expose pull mirror username and password

See merge request gitlab-org/security/gitlab!1354

Merge branch 'security-disallow-changing-timestamps-on-issue-create-update-13-9' into '13-9-stable-ee'

Prevent non-owners to set system_note_timestamp

See merge request gitlab-org/security/gitlab!1360

Merge branch 'security-322500-disable-gitaly-branch-pagination-ff-by-default-13-9' into '13-9-stable-ee'

Disable keyset pagination for branches by default

See merge request gitlab-org/security/gitlab!1368

Restrict the dependency proxy auth service

See merge request gitlab-org/security/gitlab!1371

Bump Carrierwave gem to v1.3.2

See merge request gitlab-org/security/gitlab!1351

Merge branch 'security-327155-prevent-mutation-execution-with-read-api-tokens-13-9' into '13-9-stable-ee'

Prevent mutation execution with read api tokens

See merge request gitlab-org/security/gitlab!1344

Any objects other than `User` (such as `DeployToken`) are not allowed

Changelog: security

It seems that with this feature flag enabled, pagination doesn't work
correctly in conjunction with a search. The FF is already disabled on
GitLab.com, but disabling it in the YAML file means that self-managed
instances will also be protected from the security issue (unless they
explicitly opt-in to some beta code, of course).

Changelog: security

When an issue is created or updated though API for import
purposes we allow providing created_at and updated_at params
these would then be reflected also in system notes. Only admins
and project owners should be able to set these dates.

Contributes to https://gitlab.com/gitlab-org/gitlab/-/issues/230864

* Remove password value from the pull mirror form
* Hide username from mirror url

[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Check content type before running exiftool

See merge request gitlab-org/security/gitlab!1347

Security ruby saml auth bypass fix

See merge request gitlab-org/security/gitlab!1333

Detect file format before checking exif headers

See merge request gitlab-org/security/gitlab!1339

[ci skip]

Check content type before running exiftool

See merge request gitlab-org/security/gitlab-workhorse!35

Verify that read_api tokens cannot run mutations.

Also: adds tests use of OAuth tokens for GraphQL

We make some changes to the sessionless_authentication module
in order to capture the request_authenticator, so that we can access
the token scopes, without making any extra queries.

We ensure we always authorize the mutation, which, like all resolvers,
needs to opt in to the check.

Unlike resolvers, mutations should always raise. So
`BaseMutation.authorized?` raises on failure.

Logic for handling scopes is pushed down to the `ObjectAuthorization`
class, and encapsulated in the `ScopeValidator`, which limits the
methods that can be called by resolvers.

Assures that exiftool runs for jpeg/tiff images only.

Charlie Ablett authored 3 years ago and Jan Provaznik committed 3 years ago

Before running exiftool from rake task, file's MIME type is checked.

[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Escape HTML on scoped labels tooltip

See merge request gitlab-org/security/gitlab!1324