Fix directory traversal vulnerabilities

Fixes gitlab/gitlab-ee#272.

As @joern mentions:

> This is not exploitable via the front-end nginx. But nevertheless this issue should be addressed.

See merge request !1760

Allow user to choose which email to be public

This commit allows user to show one of their emails in profile page,
or don't show email in this page.

This reverts commit 79b4d0b0, reversing
changes made to a1e147ce.

Revert "Merge branch 'fix_email_images' into 'master'"

This reverts commit d66148ef, reversing
changes made to cdb64a81.

This change needed to be reverted,
because not enough email clients support inline images.

/cc @DouweM As discussed before. I'll try to create a MR to allow access to all images this week. I'm a bit busy at the moment so no guarantees. ;)

See merge request !513

Fix wrong merged changelog entries

See merge request !514

fix stuck MR

If `locked_at` is `nil` return that the merge has been locked long enough and those are old merges stuck in locked state.

Fixes #348. Related to 64874193.

See merge request !517

Remove the invalid key factories

They're only used once each, and they're easy to build in-place.

See merge request !1766

Speed up the overridden `link_to` helper

Only bothers to check the provided link's external status if it's a String that doesn't begin with a path or anchor character.

See merge request !1767

fixes #348. related to 64874193.

fix failing test

This should fix:

```
Coverage report generated for RSpec to /home/gitlab-runner/tmp/builds/project-1/coverage. 4331 / 8315 LOC (52.09%) covered.
/home/gitlab-runner/lib/ruby/gems/2.1.0/gems/racc-1.4.10/lib/racc/parser.rb:532:in `on_error':  (Racc::ParseError)
parse error on value "Background" (BACKGROUND)
	from /home/gitlab-runner/lib/ruby/gems/2.1.0/gems/racc-1.4.10/lib/racc/parser.rb:264:in `_racc_do_parse_c'
	from /home/gitlab-runner/lib/ruby/gems/2.1.0/gems/racc-1.4.10/lib/racc/parser.rb:264:in `do_parse'
	from /home/gitlab-runner/lib/ruby/gems/2.1.0/gems/gherkin-ruby-0.3.1/lib/gherkin_ruby/parser/lexer.rb:31:in `scan_str'
	from gherkin.y:107:in `parse'
	from /home/gitlab-runner/lib/ruby/gems/2.1.0/gems/gherkin-ruby-0.3.1/lib/gherkin_ruby.rb:8:in `parse'
	from /home/gitlab-runner/lib/ruby/gems/2.1.0/gems/spinach-0.8.7/lib/spinach/parser.rb:39:in `parse'
	from /home/gitlab-runner/lib/ruby/gems/2.1.0/gems/spinach-0.8.7/lib/spinach/runner.rb:75:in `block in run'
	from /home/gitlab-runner/lib/ruby/gems/2.1.0/gems/spinach-0.8.7/lib/spinach/runner.rb:74:in `each'
	from /home/gitlab-runner/lib/ruby/gems/2.1.0/gems/spinach-0.8.7/lib/spinach/runner.rb:74:in `run'
	from /home/gitlab-runner/lib/ruby/gems/2.1.0/gems/spinach-0.8.7/lib/spinach/cli.rb:27:in `run'
	from /home/gitlab-runner/lib/ruby/gems/2.1.0/gems/spinach-0.8.7/bin/spinach:15:in `<top (required)>'
	from /home/gitlab-runner/bin/spinach:23:in `load'
	from /home/gitlab-runner/bin/spinach:23:in `<main>'
rake aborted!
```

Seems that I deleted a bit to much with my last attempt to remove the failing test.
I've run the entire spinach suite again locally and it seems to pass.

See merge request !516

Remove failing test

Earlier today I accepted a MR that removed the redundant help link on the dashboard sidebar.
This MR removes the now failing test.

See merge request !515

Explicitly set image alt to prevent graphical glitches

Rails image_tag sets the alt-attribute to the filename which causes graphical glitches if the file could not be loaded.

Fixes https://github.com/gitlabhq/gitlabhq/issues/6036.
Signed-off-by: Sven Strickroth <email@cs-ware.de>

See merge request !503

Rails image_tag sets the alt-attribute to the filename which causes graphical glitches if the file could not be loaded.

Fixes https://github.com/gitlabhq/gitlabhq/issues/6036.
Signed-off-by: Sven Strickroth <email@cs-ware.de>

Removed help link from sidebar

Closes #1349

I don't see the point in having two links on the page that will do the same thing.

See merge request !483

gitlab 7.9.2

Fresh gitlab in Dockerfile

See merge request !501

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

Conflicts:
	db/schema.rb

Only allow users to reference groups, projects, issues, MRs, commits they have access to.

Addresses https://dev.gitlab.org/gitlab/gitlabhq/issues/2183.

See merge request !1742

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

By imposing this rule we avoid having to demand that 'ldapmain' exists
in the settings initializer.

Skip email confirmation when set by admin or via LDAP.

Addresses private issue https://dev.gitlab.org/gitlab/gitlabhq/issues/2203.

See merge request !494

Warn when gitlab-shell version doesn't match requirement.

Addresses private issue https://dev.gitlab.org/gitlab/gitlabhq/issues/1791.

See merge request !495

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

This reverts commit d66148ef, reversing
changes made to cdb64a81.

This change needed to be reverted,
because not enough email clients support inline images.