Fix Import/Export security specs

Related https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/1987#note_83855

See merge request !1997

Import/Export security specs

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/20857

Related: https://gitlab.com/gitlab-org/gitlab-ce/issues/20821/

See merge request !1987

Fixed slash commands not loading

## What does this MR do?

Fixes an issue with slash commands not working when the autocomplete source is loading & then the new issue button is clicked. This also fixes an issue where the autocomplete source is loaded on pages where it isn't actually needed.

## What are the relevant issue numbers?

Closes #21774, #21807

See merge request !6207

Add docs on Cycle Analytics

Document Cycle Analytics first iteration https://gitlab.com/gitlab-org/gitlab-ce/issues/21170

See merge request !6437

Test if issue authors can access private projects

See merge request !6419

Post-merge improve of CI permissions

Improves code from !6409

See merge request !6432

Bump GITLAB_SHELL_VERSION to 3.6.0 for SSH support for LFS.

cc @rdavila

See merge request !6441

Fix new project button alignment

## What does this MR do?
Increases the width of the button/search container to fit all items at smaller screen width. The left side of the row can only have a max of two tabs (All Projects, Shared Projects), so everything can still fit on one line until they resize for mobile

## Why was this MR needed?
The `New project` button wrapped to next line at smaller screen width, breaking the layout

## Screenshots (if relevant)
![Screen_Shot_2016-09-09_at_11.44.27_AM](/uploads/a726208deec6623d9fb62db0a549bf38/Screen_Shot_2016-09-09_at_11.44.27_AM.png)
![Screen_Shot_2016-09-09_at_11.46.29_AM](/uploads/bd8dc911757b14c5fafc4d3849e0b242/Screen_Shot_2016-09-09_at_11.46.29_AM.png)

## What are the relevant issue numbers?
Closes #20310

See merge request !6286

Limit number of shown environments

## What does this MR do?

This MR limits in context of Merge Request a list of shown environments. Previously we would show all environments containing the SHA of the head commit of Merge Request. However, with introducing of dynamically created environments this lead to a cases that we would show multiple review apps, for different branches, because these branches would contain a new questioned commit.

This MR changes what environments we test against presence of the commit, to:
1. We look for environments with deployments to source_branch of source_project: used for deployments to per-branch environments,
2. We look for environments with deployments to target_branch of target_project: used for deployments to staging / production environments,
3. We look for environments with deployments for tags on target_project: used for staging / production environments.

## Why was this MR needed?

To improve a list of returned environments when we introduced ability to create dynamic environments for review apps:
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/6323

See merge request !6438

Show all pipelines from all merge_request_diffs

This way we could also show pipelines from commits which
were discarded due to a force push.

Closes #21889

See merge request !6414

And Snippets get awards

## What does this MR do?

Makes snippets more awesome, by making them awardables

## Why was this MR needed?

Because Snippets were left behind.

## What are the relevant issue numbers?

Closes #17878

See merge request !4456

Cycle Analytics: first iteration

## What does this MR do?

- Implement the first iteration of the "Cycle Analytics" feature.

## What are the relevant issue numbers?

- Closes #21170 

## Screenshots

![cycle_analytics_screencast.gif](/uploads/d23c3c912caa6935fd47b53ca3a56b97/cycle_analytics.gif)

## Backend Tasks

- [x]  Implementation
    - [x]  Phases
        - [x]  Issue (Tracker)
        - [x]  Plan (Board)
        - [x]  Code (IDE)
        - [x]  Test (CI)
        - [x]  Review (MR)
        - [x]  Staging (CD)
        - [x]  Production (Total)
    - [x]  Make heuristics more modular
    - [x]  Scope to project
    - [x]  Date range (30 days, 90 days)
    - [x]  Access restriction
- [x]  Test
    - [x]  Find a better way to test these phases
    - [x]  Phases
        - [x]  Issue (Tracker)
        - [x]  Plan (Board)
        - [x]  Code (IDE)
        - [x]  Test (CI)
        - [x]  Review (MR)
        - [x]  Staging (CD)
        - [x]  Production (Total)
    - [x]  Test for "end case happens before start case"
    - [x]  Consolidate helper
- [x]  Miniboss review
- [x]  Performance testing with mock data
- [x]  Improve performance
    - [x]  Pre-calculate "merge requests closing issues
    - [x]  Pre-calculate everything else
- [x]  Test performance against 10k issues
- [x]  Test all pre-calculation code
    - [x]  Ci::Pipeline -> build start/finish
    - [x]  Ci::Pipeline#merge_requests
    - [x]  Issue -> record default metrics after save
    - [x]  MergeRequest -> record default metrics after save
    - [x]  Deployment -> Update "first_deployed_to_production_at" for MR metrics
    - [x]  Git Push -> Update "first commit mention" for issue metrics
    - [x]  Merge request create/update/refresh -> Update "merge requests closing issues"
- [x]  Remove `MergeRequestsClosingIssues` when necessary
- [x]  Changes to unblock Fatih
    - [x]  Add summary data
    - [x]  `stats` should be array
    - [x]  Let `stats` be `null` if all `stats` are null
- [x]  Indexes for "merge requests closing issues"
- [x]  Test summary data
- [x]  Scope everything to project
    - [x]  Find out why tests were passing
- [x]  Filter should include issues/MRs which have made it to production within the range
- [x]  Don't create duplicate `MergeRequestsClosingIssues`
- [x]  Fix tests
- [x]  MySQL median
- [x]  Assign to Douwe for review
- [x]  Fix conflicts
- [x]  Implement suggestions from Yorick's review
    - [x]  Test on PG
    - [x]  Test on MySQL
- [x]  Refactor
    - [x]  Cleanup
        - [x]  What happens if we have no data at all?
        - [x]  Extract common queries to methods / scopes
    - [x]  Remove unused queries
    - [x]  Downtime for foreign key migrations
    - [x]  Find a way around "if issue.metrics.present?" all over the place
    - [x]  Find a way around "if merge_request.metrics.present?" all over the place
    - [x]  Test migrations on a fresh database
        - [x]  MySQL
        - [x]  Pg
- [x]  Access issues
    - While the project is public and the visibility is set to "Everyone with access", you cannot visit the cycle analytics page when signed out.
- [x]  CHANGELOG
- [x]  Implement suggestions from Douwe's review
    - [x]  First set of comments
    - [x]  Second set of comments
    - [x]  Third set of comments
    - [x]  Fourth set of comments
- [x]  Make sure build is green
- [ ]  Make issue for "polish"
- [ ]  EE MR


See merge request !5986

Add spec covering 'committer_hash'

Adds a missing spec from changes added in !5822

See merge request !6433

Revert "Merge branch 'rs-update-rubocop-rspec' into 'master'"

Reverts https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/6357
due to rubocop-rspec dropping support for Ruby 2.1.

See https://github.com/backus/rubocop-rspec/pull/131

See merge request !6444

Add default values for ProjectFeature

See merge request !6447

See !6196.

See gitlab-org/gitlab-ce!6247.
Signed-off-by: Rémy Coutable <remy@rymai.me>

It was accidentally intropduced when doing a cherry-pick of a merge
request commit.

Fix branch title trailing space on hover

## What does this MR do?
Removes the unnecessary encapsulation of the `<span>` inside of the `<a>` which was creating the trailing space on hover. 

## Are there points in the code the reviewer needs to double check?
Shouldn't be

## Why was this MR needed?
Makes the UI look more polished

## What are the relevant issue numbers?
Closes #20676 

## Screenshots (if relevant)
Before (When hovering on branch title):
![Screen_Shot_2016-08-05_at_2.54.43_PM](/uploads/1c90ae1ed69268a2fdcdafdede267028/Screen_Shot_2016-08-05_at_2.54.43_PM.png)

After (When hovering on branch title):
![Screen_Shot_2016-08-05_at_2.54.19_PM](/uploads/6eab261a343e7acb6223ed205443b644/Screen_Shot_2016-08-05_at_2.54.19_PM.png)

## Does this MR meet the acceptance criteria?

- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- Tests
  - [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !5688

Add delimiter to project stars and forks count

## What does this MR do?
Adds the `number_with_delimiter()`to the project stars and fork counts on the projects dashboard.

## Are there points in the code the reviewer needs to double check?
Shouldn't be any 😃  

## Why was this MR needed?
Improve readability and adhere to the [UI guide](https://gitlab.com/help/development/ui_guide.md#counts)

## What are the relevant issue numbers?
Closes #20746 

## Screenshots (if relevant)
Before:
![Screen_Shot_2016-08-09_at_1.30.44_PM](/uploads/69592ce220d64774e265cfbcfcb6864a/Screen_Shot_2016-08-09_at_1.30.44_PM.png)

After:
![Screen_Shot_2016-08-09_at_1.30.58_PM](/uploads/1470179256614c2e47cc9d0e49aeaf09/Screen_Shot_2016-08-09_at_1.30.58_PM.png)

## Does this MR meet the acceptance criteria?

- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- Tests
  - [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !5741

Fix issues with wrong issues/merge request counts when filters are selected

Closes #15356 plus counter for issues and MR are now displayed for the these paths `https://gitlab.com/groups/group-name/issues`  `https://gitlab.com/groups/group-name/merge_requests`  `https://gitlab.com/dashboard/issues` and  `https://gitlab.com/dashboard/merge_requests`

See merge request !4960

Security and safety improvements for gitlab-workhorse integration

Companion to https://gitlab.com/gitlab-org/gitlab-workhorse/merge_requests/60

- Use a custom content type when sending data to gitlab-workhorse
- Verify (using JWT and a shared secret on disk) that internal API requests came from gitlab-workhorse

This will allow us to build features in gitlab-workhorse that require
more trust, and protect us against programming mistakes in the future.

This is designed so that no action is required for installations from
source. For omnibus-gitlab we need to add code that manages the shared
secret.

See merge request !5907
Conflicts:
	GITLAB_WORKHORSE_VERSION
	doc/install/installation.md
	doc/update/8.11-to-8.12.md
	lib/gitlab/workhorse.rb
	spec/lib/gitlab/workhorse_spec.rb
	spec/requests/ci/api/builds_spec.rb
	spec/requests/git_http_spec.rb

Allow the Rails cookie to be used for API authentication

Makes the Rails cookie into a valid authentication token for the Grape
API, and uses it instead of token authentication in frontend code that
uses the API.

Rendering the private token into client-side javascript is a security
risk; it may be stolen through XSS or other attacks. In general,
re-using API code in the frontend is more desirable than implementing
endless actions that return JSON. 

Closes #18302

See merge request !1995

Allow to set request_access_enabled for groups and projects using API

Closes #20978

See merge request !6359

Only create a protected branch upon a push to a new branch if a rule for that branch doesn't exist

A customer ran into an issue where a Sidekiq task retried over and over, leading to duplicate master branches in their protected branch list.
    
Closes #22177

See merge request !6399

Fixes labels multi-encode and selecting labels with single quotes

## What does this MR do?

Replaced single quotes with escaped single quotes when setting item `.is-active` and when removing its field.

Adds a test to test selecting 2 different labels _(one with a single quote)_ with a full page load inbetween, it checks the labels are selected as well as shown as `.is-active` in the list.

## Are there points in the code the reviewer needs to double check?



## Why was this MR needed?

The javascript handles the url encoding when it is sent to the server so we shouldn't let the javascript begin processing an already encoded string but we needed to stop single quotes from breaking a jquery selector.

## Screenshots (if relevant)

https://youtu.be/-H0_L2hV9tM

## Does this MR meet the acceptance criteria?

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [ ] All builds are passing
- [ ] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [ ] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [ ] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

Closes #21961

Closes #21880

Closes #21248

Closes #20759

Closes #21935

See merge request !6313

Improve build trace scroll controls

## What does this MR do?

The trace step buttons now correctly scroll to the top or bottom of the build trace, rather than jumping inconsistently and never full reaching the top due to the fixed position of the header/navigation area.

## Are there points in the code the reviewer needs to double check?

## Why was this MR needed?

Build trace UX

## Screenshots (if relevant)

![2016-09-09_20.04.32](/uploads/efee5145fb505f8c9ae2a4cf24d842d3/2016-09-09_20.04.32.gif)

## Does this MR meet the acceptance criteria?

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [ ] All builds are passing
- [ ] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [ ] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [ ] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

Contributes to #21832.

See merge request !6288

Fixed large comments messing with diff table widths

## What does this MR do?

Fixes the width of the diff table so that the content inside it can't increase or decrease the width of the table cells.

## Screenshots (if relevant)

![Screen_Shot_2016-09-12_at_14.44.44](/uploads/2ca483399d867153e6ae608360ffea5f/Screen_Shot_2016-09-12_at_14.44.44.png)

## What are the relevant issue numbers?

Closes #20694

See merge request !6309

Ensure invitees are not returned in Members API

## What are the relevant issue numbers?

Closes #22065

See merge request !6370

Use gitlab-workhorse 0.8.2

Fixes rejected API git archive extensions; improves Sentry errors.

https://gitlab.com/gitlab-org/gitlab-workhorse/blob/master/CHANGELOG

See merge request !6388

Fix broken spec due to last_activity_at updates being throttled

In https://gitlab.com/gitlab-org/gitlab-ce/builds/4218398, the build failed because the last_activity_at column was only being updated once per hour. We
can fix this spec by stubbing out the throttling and adjusting the spec to test the right event timestamp.

See merge request !6424

Strip comments before sending keys to gitlab-shell

## Why was this MR needed?

https://gitlab.com/gitlab-org/gitlab-ce/issues/22167 encoding issues in comment text.

## What are the relevant issue numbers?

https://gitlab.com/gitlab-org/gitlab-ce/issues/22167

See merge request !6381

Hide jump to next discussion button on commit notes

## What are the relevant issue numbers?

Closes #22354

See merge request !6428

Fix "Unsubscribe" link in notification emails that is triggered by anti-virus

## What does this MR do?

* The unsubscribe link in an email body only unsubscribes automatically when logged in, otherwise the user is asked for a confirmation.
* The unsubscribe link in an email header unsubscribes automatically whether logged in or not.

## Are there points in the code the reviewer needs to double check?

This addresses all the comments from https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5241, I think!

## Why was this MR needed?

People were getting unsubscribed automatically by AV software.

## Screenshot

![Screen_Shot_2016-09-20_at_09.51.30](/uploads/083ee2865f1ad6c08e2ed97f1c4e7d0d/Screen_Shot_2016-09-20_at_09.51.30.png)

## Does this MR meet the acceptance criteria?

- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- Tests
  - [x] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

Fixes #17198.

See merge request !6223

Lets the user choose a namespace and name on Github imports

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/14971

See merge request !5728

Use a ConnectionPool for Rails.cache on Sidekiq servers

See merge request !6429

Restrict last_activity_at updates to one per hour

This MR reduces the number of updates to `projects.last_activity_at` to once per hour.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/22213

See merge request !6391

LFS support for ssh enabled

## What does this MR do?
This is follow-up after https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/6043 which is falsely shown as merged due to: https://gitlab.com/gitlab-org/gitlab-ce/issues/22334

## Are there points in the code the reviewer needs to double check?

## Why was this MR needed?

## Screenshots (if relevant)

## Does this MR meet the acceptance criteria?

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [ ] All builds are passing
- [ ] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [ ] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [ ] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

See merge request !6413