[merge-train skip]

[ci skip]

[ci skip]

Enforce Jira namespace permissions

See merge request gitlab-org/security/gitlab!1698

Prevent non-admins from configuring Jira connect app

See merge request gitlab-org/security/gitlab!1697

Changelog: security

This prevents non-admins from creating Jira Connect namespace
subscriptions.

This additional check is controlled by a new ops feature flag
(`jira_connect_require_site_admins`) so that it can be disabled
for self-hosted installations if required.

Changelog: security

Update apollo_upload_server dependency

See merge request gitlab-org/security/gitlab!1699

Update Import/Export to use public email when mapping users

See merge request gitlab-org/security/gitlab!1669

Require sign in for .keys endpoint on non-public instances

See merge request gitlab-org/security/gitlab!1676

Merge branch 'security-fix-privelege-escalation-from-external-to-internal-14-2' into '14-2-stable-ee'

Inherit user external status while creating project bots

See merge request gitlab-org/security/gitlab!1675

Make design filename pattern stricter

See merge request gitlab-org/security/gitlab!1680

Fix stored XSS in the Jira issue detail pages

See merge request gitlab-org/security/gitlab!1673

Fix stored XSS vulnerability in Datadog settings form

See merge request gitlab-org/security/gitlab!1670

Ensure shared group members lose project access after group deletion

See merge request gitlab-org/security/gitlab!1683

This enables us to make use of `strict_mode`, preventing denial of
service attacks.

Changelog: security

When a group is invited to shared access with a project, and the
group is later deleted, this change ensures the members
of the group no longer have access to the project.

Changelog: security

[merge-train skip]

[ci skip]

[ci skip]

Prepare 14.2.1-ee release

See merge request gitlab-org/gitlab!68723

Tiger Watson authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68710

Changelog: fixed

Paul Slaughter authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Fix getAction is undefined bug

See merge request gitlab-org/gitlab!68583

(cherry picked from commit 68a1bbf8)

e2c3e429 Fix getAction is undefined bug
17ee120d Apply code review suggestions
83aced3a Remove unused constant
f00c004c Apply 2 suggestion(s) to 1 file(s)

Savas Vedova authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68503

Changelog: changed
EE: true

Saikat Sarkar authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68313

Changelog: changed
EE: true

Achilleas Pipinellis authored 3 years ago and GitLab Release Tools Bot committed 3 years ago

Adding upgrade messaging for PK migrations

See merge request gitlab-org/gitlab!68088

(cherry picked from commit 5294ec47)

c4e15b8c Adding upgrade messaging for PK migrations
92504d7c Apply 1 suggestion(s) to 1 file(s)
ea7ce211 Apply 1 suggestion(s) to 1 file(s)
25aae5a8 Apply 1 suggestion(s) to 1 file(s)
43845e24 Apply 2 suggestion(s) to 1 file(s)

The pattern which detects possible design filenames should
be stricter to make sure that we don't match any special characters
or quoted strings which could lead to XSS.

Change: security

Changelog: security
EE: true

To make the behavior of /username.keys endpoint
with /api/v4/users/:id/keys endpoint

Changelog: security

Project bots should be external if created by external user

Changelog: security

[merge-train skip]

[ci skip]

[ci skip]

Changelog: security
EE: true

Previously we generated the URL for the link in the help text based on
the user-submitted value in `datadog_site`, which caused a stored XSS
vulnerability.

This was accidentally fixed with the HTML-escaping we added in
https://gitlab.com/gitlab-org/gitlab/-/merge_requests/66391 while
improving the help texts for this integration.

But this still leaves some room for exploitation by changing the URL
of a seemingly-trusted link, so instead we just hard-code the default
link to the documentation on docs.datadoghq.com, and remove the custom
link which goes directly to the user's API settings.

Changelog: security

[merge-train skip]

Use UPSERT when storing user mentions

See merge request gitlab-org/gitlab!68433

Scheduled secret detection scan for security policy

See merge request gitlab-org/gitlab!67752

Adds a feature flag to the optimization done for store_mentions!