[merge-train skip]

[ci skip]

[ci skip]

Don't allow to add users to project with email different than group sett

See merge request gitlab-org/security/gitlab!1563

Hide project-level CI/CD Analytics page for Guest users

See merge request gitlab-org/security/gitlab!1574

Merge branch 'security-not-allow-to-impersonate-tokens-while-impersonation-is-off-14-0' into '14-0-stable-ee'

Block pushing with impersonation token if impersonation is disabled

See merge request gitlab-org/security/gitlab!1584

Changelog: security

This commit updates the project-level CI/CD Analytics page to not be
accessible by Guest users of private projects.

Changelog: security

Add permissions check to pipelines#show action

See merge request gitlab-org/security/gitlab!1613

Disallow non-members to set issue metadata on issue create

See merge request gitlab-org/security/gitlab!1581

Do not show email address in error message

See merge request gitlab-org/security/gitlab!1597

Misleading username could lead to impersonation in using SSH Certificates

See merge request gitlab-org/security/gitlab!1610

Remove impersonation token from api response for non-admin user

See merge request gitlab-org/security/gitlab!1566

Only allow invite to be accepted by user with matching email

See merge request gitlab-org/security/gitlab!1633

Add html escaping for default branch name

See merge request gitlab-org/security/gitlab!1631

Configure OmniAuth to use GitLab AppLogger

See merge request gitlab-org/security/gitlab!1616

Merge branch 'security-prevent-guests-from-creating-issues-with-sentry-error-14-0' into '14-0-stable-ee'

Prevent Guest users from creating issues linked to Sentry errors

See merge request gitlab-org/security/gitlab!1588

Updates oauth to 0.5.6

See merge request gitlab-org/security/gitlab!1568

Unauthorized User Can Trigger Deployment to the Protected Environment

See merge request gitlab-org/security/gitlab!1607

Fix tag ref detection for pipelines

See merge request gitlab-org/security/gitlab!1548

Restrict access to instance-level security features for reporters

See merge request gitlab-org/security/gitlab!1539

[14.0] Fix XSS in Mermaid Markdown rendering

See merge request gitlab-org/security/gitlab!1489

Filter todos whose target users no longer have access to [RUN AS-IF-FOSS]

See merge request gitlab-org/security/gitlab!1554

Previously, any user was able to accept an invite even if the
user's email addresses didn't match the invite. A note was
displayed but the invite could still be accepted. With this
change, a user without a matching, confirmed email address
is unable to accept the invite.

Changelog: security

This escapes html chars for default branch
name value in initializing repository instructions

This is to prevent XSS vulnerability

Changelog: security

OmniAuth logger was not being configured properly and some logs
were being dropped. This change ensures OmniAuth log messages
are output to `application.log` and/or `application_json.log`
as appropriate depending on configuration.

Fix Group SAML Spec order dependency

Change `allow/expect_any_instance_of` to
`allow/expect_next_instance_of` to avoid leaking state from other
tests.

Changelog: security

This check renders a 404 in case the user trying
to access the pipeline details page doesn't have enough
permissions

Changelog: security

Jose Ivan Vargas Lopez authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Disable browserslist warning in CI jobs

See merge request gitlab-org/gitlab!66942

(cherry picked from commit 89dec6ec)

61c4eacf Disable browserslist warning in CI jobs

Matthias Käppler authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Merge branch '333819-flaky-test-ee-spec-services-iterations-roll_over_issues_service_spec-rb-82-iterations' into 'master'

Resolve broken test on PG11 [RUN ALL RSPEC]

See merge request gitlab-org/gitlab!64230

(cherry picked from commit 39f94c3d)

575b3db9 Fix a spec that was broken with PG11

Updates the gitlab-shell version to include a security patch.

Changelog: security

Protected Environment Accesses were not automatically cleaned up
when a user was removed from the project membership.
Also, the leftover user/group entry in the access list
couldn't be removed manually.

This commit fixes these security related bugs.

Changelog: security
EE: true

Changelog: security
EE: true

When creating an issue a guest member is allowed to set issue
metadata, however in public projects authenticated non-members
get guest access as well, so we would restrict permission to
set issue metadata for non-members specifically.

Changelog: security

Changelog: security

[merge-train skip]

[ci skip]

[ci skip]

Prepare 14.0.6-ee release

See merge request gitlab-org/gitlab!66403

Changelog: security

alex pooley authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/65954

Changelog: fixed