In the Snippets::NotesController the noteable was resolved and
authorized through the :snippet_id, so by passing a :target_id for a
different snippet it was possible to create a note on a snippet
where the user would be unauthorized to do so otherwise.

This fixes the problem by ignoring the :target_id and :target_type from
the request, and using the same noteable for creation and authorization.

[ci skip]

Prepare 11.11.2 release

See merge request gitlab-org/gitlab-ce!28679

Fix project settings not being able to update

Closes #62708

See merge request gitlab-org/gitlab-ce!29097

Fix migration failure when groups are missing route

Closes #58714

See merge request gitlab-org/gitlab-ce!29022

(cherry picked from commit 0488c26e)

a52cbf6b Fix migration failure when groups are missing route

Stop two-step rebase from hanging when errors occur

See merge request gitlab-org/gitlab-ce!29060

This change makes sure Gitaly includes a fix to make rebase work again
properly.

Part of: https://gitlab.com/gitlab-org/gitlab-ce/issues/62353

Disable two_step_rebase feature flag

See merge request gitlab-org/gitlab-ce!28778

(cherry picked from commit 715d1057)

8104eef0 Disable two_step_rebase feature flag
dd1fa0c2 Apply suggestion to changelogs/unreleased/dm-disable-two-step-rebase.yml

Use source ref in pipeline webhook

Closes #61553

See merge request gitlab-org/gitlab-ce!28772

(cherry picked from commit 2714f85c)

7e05f3b7 Use source ref for pipeline webhook

Fix OmniAuth OAuth2Generic strategy not loading

Closes #62216

See merge request gitlab-org/gitlab-ce!28680

(cherry picked from commit 7b5cc7b4)

bf8f4c13 Fix OmniAuth OAuth2Generic strategy not loading

Fix display of promote to group label

Closes #62200

See merge request gitlab-org/gitlab-ce!28637

(cherry picked from commit 9c2d0d87)

f9a55f93 Fix display of promote to group label
52764ec5 Apply suggestion to spec/helpers/labels_helper_spec.rb
58dc21e7 Apply suggestion to spec/features/projects/labels/user_promotes_label_spec.rb

Update SAST.gitlab-ci.yml - Add SAST_GITLEAKS_ENTROPY_LEVEL

Closes #62179

See merge request gitlab-org/gitlab-ce!28607

(cherry picked from commit 2ae642f8)

31e181f8 Update SAST.gitlab-ci.yml - Add SAST_GITLEAKS_ENTROPY_LEVEL

Fix height of input groups

Closes #61304, #61303, #59254, and #60778

See merge request gitlab-org/gitlab-ce!28495

(cherry picked from commit 52758b92)

360646ea Fix height of input groups

[ci skip]

Add DNS rebinding protection settings

See merge request gitlab/gitlabhq!3130

Fix the overriding of EE import params

See merge request gitlab/gitlabhq!3129

Reject slug+uri concat if slug is deemed unsafe

See merge request gitlab/gitlabhq!3105

Persistent XSS in note objects

See merge request gitlab/gitlabhq!3127

Fix url redaction for issue links

See merge request gitlab/gitlabhq!3092

Disallow invalid MR branch name

See merge request gitlab/gitlabhq!3095

Hide issue title on unsubscribe for anonymous users

See merge request gitlab/gitlabhq!3099

Fix confidential issue label disclosure on milestone view

See merge request gitlab/gitlabhq!3102

Handling password on import by url page

See merge request gitlab/gitlabhq!3109

Resolve: Milestones leaked via search API

See merge request gitlab/gitlabhq!3110

Protect Gitlab::HTTP against DNS rebinding attack

See merge request gitlab/gitlabhq!3113

Update Gitaly to fix GetArchive vulnerability

See merge request gitlab/gitlabhq!3118

Prevent password sign in restriction bypass

See merge request gitlab/gitlabhq!3121

First reported:
  https://gitlab.com/gitlab-org/gitlab-ce/issues/60143

When the page slug is "javascript:" and we attempt to link to a relative
path (using `.` or `..`) the code will concatenate the slug and the uri.
This MR adds a guard to that concat step that will return `nil` if the
incoming slug matches against any of the "unsafe" slug regexes;
currently this is only for the slug "javascript:" but can be extended if
needed. Manually tested against a non-exhaustive list from OWASP of
common javascript XSS exploits that have to to with mangling the
"javascript:" method, and all are caught by this change or by existing
code that ingests the user-specified slug.

Replaces a hard-coded date in the job app spec

Closes #62283

See merge request gitlab-org/gitlab-ce!28709

Gitlab::HTTP now resolves the hostname only once, verifies the IP is not
blocked, and then uses the same IP to perform the actual request, while
passing the original hostname in the `Host` header and SSL SNI field.