[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Update mermaid to version 8.9.2

See merge request gitlab-org/security/gitlab!1363

Do not expose pull mirror username and password

See merge request gitlab-org/security/gitlab!1355

Merge branch 'security-disallow-changing-timestamps-on-issue-create-update-13-10' into '13-10-stable-ee'

Prevent non-owners to set system_note_timestamp

See merge request gitlab-org/security/gitlab!1359

Merge branch 'security-322500-disable-gitaly-branch-pagination-ff-by-default-13-10' into '13-10-stable-ee'

Disable keyset pagination for branches by default

See merge request gitlab-org/security/gitlab!1367

Restrict the dependency proxy auth service

See merge request gitlab-org/security/gitlab!1370

Bump Carrierwave gem to v1.3.2

See merge request gitlab-org/security/gitlab!1350

Merge branch 'security-327155-prevent-mutation-execution-with-read-api-tokens-13-10' into '13-10-stable-ee'

Prevent mutation execution with read api tokens

See merge request gitlab-org/security/gitlab!1343

Any objects other than `User` (such as `DeployToken`) are not allowed

Changelog: security

It seems that with this feature flag enabled, pagination doesn't work
correctly in conjunction with a search. The FF is already disabled on
GitLab.com, but disabling it in the YAML file means that self-managed
instances will also be protected from the security issue (unless they
explicitly opt-in to some beta code, of course).

Changelog: security

When an issue is created or updated though API for import
purposes we allow providing created_at and updated_at params
these would then be reflected also in system notes. Only admins
and project owners should be able to set these dates.

Contributes to https://gitlab.com/gitlab-org/gitlab/-/issues/230864

* Remove password value from the pull mirror form
* Hide username from mirror url

[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Check content type before running exiftool

See merge request gitlab-org/security/gitlab!1341

Security ruby saml auth bypass fix

See merge request gitlab-org/security/gitlab!1332

Detect file format before checking exif headers

See merge request gitlab-org/security/gitlab!1338

Verify that read_api tokens cannot run mutations.

Also: adds tests use of OAuth tokens for GraphQL

We make some changes to the sessionless_authentication module
in order to capture the request_authenticator, so that we can access
the token scopes, without making any extra queries.

We ensure we always authorize the mutation, which, like all resolvers,
needs to opt in to the check.

Unlike resolvers, mutations should always raise. So
`BaseMutation.authorized?` raises on failure.

Logic for handling scopes is pushed down to the `ObjectAuthorization`
class, and encapsulated in the `ScopeValidator`, which limits the
methods that can be called by resolvers.

Assures that exiftool runs for jpeg/tiff images only.

Charlie Ablett authored 3 years ago and Jan Provaznik committed 3 years ago

Before running exiftool from rake task, file's MIME type is checked.

By default dora4 metrics controller returns data for last 3 months

We use 2021-01-01 as fixture date in specs.

So controllers stoped returning this data on 2021-04-02

Also, max range was calculated as 91 days, while it's actually
possible to have 92 days in 3 months.
I caught this trying to fix the issue


(cherry picked from commit b76bd0d8)

[merge-train skip]

[ci skip]

[ci skip]

[ci skip]

Prepare 13.10.2-ee release

See merge request gitlab-org/gitlab!58151

Kushal Pandya authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Added frequently used emojis to new picker

See merge request gitlab-org/gitlab!56332

(cherry picked from commit 189bf0ed)

1b94ec93 Added frequently used emojis to new picker
d16914b7 Moved some re-used values into constants file
0361f42c Added specs to util methods

Jacob Vosmaer (GitLab) authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Revert "Fix long polling to default to 50 s instead of 50 ns"

See merge request gitlab-org/gitlab!57903

(cherry picked from commit d6edae81)

3b59eb25 Revert "Fix long polling to default to 50 s instead of 50 ns"

Simon Knox authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Fixed rendering of the image blobs

See merge request gitlab-org/gitlab!57479

(cherry picked from commit 299fc1e4)

274c8a8e Fixed rendering of the image blobs

Nick Gaskill authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Fix epic boards tier in docs

See merge request gitlab-org/gitlab!57404

(cherry picked from commit e4f47488)

1653bed1 Fix epic boards tier in docs

Achilleas Pipinellis authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Remove admin mode entry from What's New

See merge request gitlab-org/gitlab!57146

(cherry picked from commit 4662d25f)

562c88a9 Remove admin mode entry