Ensure external users are not able to clone disabled repositories.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/23788

See merge request !2017

disable markdown in comments when referencing disabled features

fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/23548

This MR prevents the following references when tool is disabled:

- issues
- snippets
- commits - when repo is disabled
- commit range - when repo is disabled
- milestones

This MR does not prevent references to repository files, since they are just markdown links and don't leak
information.

See merge request !2011
Signed-off-by: Rémy Coutable <remy@rymai.me>

Honour issue and merge request visibility in their respective finders

This MR fixes a security issue with the IssuesFinder and MergeRequestFinder where they would return items the user did not have permission to see. This was most visible on the issue and merge requests page for a group containing projects that had set their issues or merge requests to "private".

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/22481

See merge request !2000
Signed-off-by: Rémy Coutable <remy@rymai.me>

Signed-off-by: Rémy Coutable <remy@rymai.me>

Signed-off-by: Rémy Coutable <remy@rymai.me>

Merge branch '23872-members-of-group-that-has-project-access-getting-404-on-accessing-a-project-issue' into 'master'

Fix project member access for group links

Closes #23872.

See merge request !7144
Signed-off-by: Rémy Coutable <remy@rymai.me>

Increase z index on fixed mr tabs

Before:
<img src="/uploads/e890a4f185af87b66251d744fbe840d5/Screen_Shot_2016-10-26_at_11.58.45_AM.png" width="400px">

After:
<img src="/uploads/0bbf72888f6a47bd3027ee7dfff542da/Screen_Shot_2016-10-26_at_11.58.28_AM.png" width="400px">
Closes #23866

See merge request !7124
Signed-off-by: Rémy Coutable <remy@rymai.me>

Pass user instance to Labels::FindOrCreateService or skip_authorization: true

It fixes a bug described in #23694 when `project.owner` was passed to `Labels::FindOrCreateService`. `Labels::FindOrCreateService` expected a user instance and `project.owner` may return a group as well. This MR makes sure that we either pass a user instance or `skip_authorization: true`.

Fixes #23694

See merge request !7093
Signed-off-by: Rémy Coutable <remy@rymai.me>

Resolve "Lacking padding on syntax highlight blocks in diff comments"

Enforces horizontal padding on highlight block.

There was no horizontal padding on diff comment highlight blocks.

Closes #23661

See merge request !7062
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix refs dropdown selection with special characters

Remove unneeded encode from the project-refs-dropdown renderRow method.

Closes #21248

See merge request !7061
Signed-off-by: Rémy Coutable <remy@rymai.me>

Modify GitHub importer to be retryable

Closes #23533

See merge request !7003
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix couple of GitHub importing bugs

Fix a bug in GH comment importing and label applying for imported MRs.

See merge request !7139
Signed-off-by: Rémy Coutable <remy@rymai.me>

Only remove right connector of first build of last stage

Closes #23849

See merge request !7179
Signed-off-by: Rémy Coutable <remy@rymai.me>

Use Hash rocket syntax to fix cycle analytics under Ruby 2.1

Refers to #23510

See merge request !6977
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix encoding issues on pipeline commits

## What does this MR do?
#### What does this MR do?
Sets `escape: false` on `truncate` method to fix commit message on pipelines page

#### Screenshots (if relevant)
Before:   
![Screen_Shot_2016-10-12_at_8.53.10_AM](/uploads/5e26e98a272139fe2264c315d579178f/Screen_Shot_2016-10-12_at_8.53.10_AM.png)
After:   
![Screen_Shot_2016-10-12_at_8.52.49_AM](/uploads/58c6c69f2ba735fdcd5a0b6922b56aa7/Screen_Shot_2016-10-12_at_8.52.49_AM.png)

#### What are the relevant issue numbers?
Closes #23258

See merge request !6832

API: Fix booleans not recognized as such when using the `to_boolean` helper

Fixes #22831
Fixes #23890

See merge request !7149

Fix and improve `Sortable.highest_label_priority`

Closes #23928

See merge request !7165

Fixed sticky MR tabs positioning when sidebar is pinned

## What does this MR do?

The sticky MR tabs where positioned underneath the pinned sidebar. This fixes that by accounting for the size of the pinned nav.

## Screenshots (if relevant)

![Screen_Shot_2016-10-28_at_09.37.18](/uploads/0d23f2bb0e02d698c012c22c8653afd7/Screen_Shot_2016-10-28_at_09.37.18.png)

## What are the relevant issue numbers?

Closes #23926

See merge request !7167

Fix CHANGELOG for GH import fixes

See merge request !7173

Merge branch 'ee-1159-allow-permission-check-bypass-in-approve-access-request-service' into 'master'

Allow Members::ApproveAccessRequestService to accept a new `:force` option

## What does this MR do?

See the commit message.

This is a backport of the EE fix for https://gitlab.com/gitlab-org/gitlab-ee/issues/1159: gitlab-org/gitlab-ee!830

See merge request !7168

Update gitlab-shell version to 3.6.6

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/23659

See merge request !7118

[ci skip]

Fix events order in users/:id/events endpoint

Order of events in contributions API is currently being lost, though docs are saying:

> Get the contribution events for the specified user, sorted **from newest to oldest**.

Order becomes different after `.merge(ProjectsFinder.new.execute(current_user))` call, so I moved ordering below this line.

This MR also removes extra `.page(params[:page])` call in the method chain, since [`paginate(events)` already does it](https://gitlab.com/airat/gitlab-ce/blob/master/lib/api/helpers.rb#L112).

See merge request !7039
Signed-off-by: Rémy Coutable <remy@rymai.me>

Don't schedule ProjectCacheWorker unless needed

This MR changes `ProjectCacheWorker.perform_async` so scheduling only takes place when needed. See the commits for more details.

See merge request !7099
Signed-off-by: Rémy Coutable <remy@rymai.me>

Reduce overhead of LabelFinder by avoiding #presence call

Some users experienced 502 timeouts when viewing group labels.
Labels#open_issues_count and Label#open_merge_requests_count were
taking a long time to load because they were loading every ActiveRecord
of the user-accessible projects into memory. This change modifies so
that only the IDs are loaded into memory.

Closes #23684

See merge request !7094
Signed-off-by: Rémy Coutable <remy@rymai.me>

Stop appending templates - Temporary fix

This is the temporary fix for #23315. This stops the templates appending to any existing text.

See merge request !7050
Signed-off-by: Rémy Coutable <remy@rymai.me>

This will change the update process to checkout gitlab-shell version 3.6.6 instead of 3.6.3 as currently described in the update document

See merge request !6976

Fix branch protection API.

- Fixes the branch protection API.
- Closes #21513
- EE Merge Request: gitlab-org/gitlab-ee!718

See merge request !6215
Signed-off-by: Rémy Coutable <remy@rymai.me>

Stop unauthorized users dragging on issue boards

Closes #23763

See merge request !7096
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix `User#to_reference`

Fix the method signature of `User#to_reference` so that moving an issue with a user reference does not throw a "invalid number of arguments" exception.

1. Changes in 8.13 require `Referable`s that don't have a project
   reference to accept two arguments - `from_project` and
   `target_project`.

2. `User#to_reference` was not changed to accept the
   `target_project` (even though it is not used). Moving an issue
   containing a user reference would throw a "invalid number of
   arguments" exception.

3. The regression was introduced in [c8b2b3f7](https://gitlab.com/gitlab-org/gitlab-ce/commit/c8b2b3f7c32db873f1bebce3e3b1847ea24d235f#91fabb7ad88bd2fde6fef1c100a719c00e503047_75_79), which expects
   all `Referable`s that don't respond to `:project` to have a `to_reference`
   method that takes two arguments.

Closes #23662

See merge request !7088
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix constrainers for relative url

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/23675

See merge request !7071
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix reply-by-email not working due to queue name mismatch

See merge request !7068
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix bug where labels would be assigned to issues that were moved

If you attempt to move an issue from one project to another and leave
labels blank, LabelsFinder would assign all labels in the new project
to that issue. The issue is that :title is passed along to the Finder,
but since it appears empty no filtering is done. As a result, all
labels in the group are returned. This fix handles that case.

Closes #23668

See merge request !7065
Signed-off-by: Rémy Coutable <remy@rymai.me>

See merge request !7064
Signed-off-by: Rémy Coutable <remy@rymai.me>

Only show register tab if signup enabled.

Fixes a regression where the register tab is activated, even if sign-up enabled is not activated in application_settings.

https://gitlab.com/gitlab-org/gitlab-ce/issues/23654

See merge request !7058
Signed-off-by: Rémy Coutable <remy@rymai.me>