Load the "New Branch" button asynchronously
Here's how it looks like for logged in users:
And here it is for anonymous users (or when a new branch can't be created by a logged in user):
See merge request !3855
Refactor Todos feature spec to be faster and less brittle
We now only create two Todos instead of 21 when testing pagination, and
we've updated the test to be less brittle when dealing with slower CI
environments.
See merge request !3889
Move cherry-pick feature specs to proper directory
Cherry pick feature specs were located in `spec/feature/project` directory while we have `spec/feature/projects`.
Later location is consistent with our namespaces (we have `Projects::` namespace, not `Project::`).
See merge request !3875
Allow filtering by Owned projects on dashboard page
Closes#3799
See merge request !3762
Always read diff_view setting from the cookie
Prior, when the user had their view set to "parallel" and then visited a
merge request's changes tab _without_ passing the `view` parameter via
query string, the view would be parallel but the `Notes` class was
always instantiated with the default value from `diff_view` ("inline"),
resulting in broken markup when the form to add a line note was
dynamically inserted.
The cookie is set whenever the view is changed, so this value should
always be up-to-date.
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/14557 and https://gitlab.com/gitlab-org/gitlab-ce/issues/15285
See merge request !3732
Fix vulnerability that leaks private labels and milestones
## Summary
This fixes vulnerability that leaks information about private labels and milestones because of insecure direct object reference in issueable create service.
This affects merge requests and issues.
See https://gitlab.com/gitlab-org/gitlab-ce/issues/15439
## Fix
This MR introduces additional check that rejects labels and milestone that does not belong to the same project issue/merg request does.
## Further work
`IssuableBaseService` may benefit from encapsulating filters in separate class/module, which then may improve coherency in this class.
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15439
See merge request !1954
Fix cross-project label ref used with invalid project
When cross-project label reference was used with invalid project reference, `nil` was assigned to project variable which later caused an exception.
Closes#15168
See merge request !3811
Fix setting of "action" for Grape transactions
After wondering why we're not getting all the data in Grafana that I
wanted I realized I wasn't setting the "action" field properly here.
See merge request !3842
Add raw build trace output
Closes#15308, #15147
Changes in the UI:
- on finished build:
- on running build:
See merge request !3767
add slack notifications for wiki pages
## What does this MR do?
Lets the Slack service be configured to send notifications when wiki pages are created or edited.
## Are there points in the code the reviewer needs to double check?
I'm just starting to get familiar with the Gitlab codebase and I was unsure on how to get the wiki page url to pass it to the slack message, on whether or not I needed to refactor the create/update methods for wiki pages from the controller to a service (but seemed necessary to test it better), and if I needed to add a column to the web hooks table or if the services table would have been enough. Please let me know if I should change anything and I will improve the MR, thanks for checking :)
## Why was this MR needed?
Related to #563 and fixes#4233.
See merge request !2998
Sanitize branch names for confidential issues
- When creating new branches for confidential issues, prefer a branch name like `issue-15` to `some-sensitive-issue-title-15`.
- The behaviour for non-confidential issues stays the same.
Closes#14566
See merge request !3671
Remove persistent XSS vulnerability in `commit_person_link` helper
Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.
Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126
See merge request !1948
API: Present an array of Gitlab::Git::Tag instead of array of rugged tags
The annotated message was always `null` because the wrong array was presented.
The entity requires an array of `Gitlab::Git::Tags` instead an array of raw rugged tags was presented. Since a rugged tag does not respond to `message` to get the annotated message, this was always `null`.
See merge request !3764
* 'master' of dev.gitlab.org:gitlab/gitlabhq:
Add Changelog entry for group link permissions fix
Use guard clause to check ability to share project
Refactor method that shares project with a group
Check permissions when sharing project with group
Implement after_script which allows to do cleanups as part of the build process
This implements `after_script` in global context.
The `after_script` will be executed always after the job, even if the job were canceled.
This requires changes on Runner side that will be implemented in 1.2.
cc @tmaczukin @grzesiek
See merge request !3771
Added System Hooks for push and tag_push
Implements `push` and `tag_push` events for System Hooks.
They are based on Webhooks Events but without any deprecated item. We don't send commits too.
We are implementing this, to be used by Geo repository syncing (gitlab-org/gitlab-ee#76).
These hook events will be sent only when the respective configuration flags are set to true.
UI changes to admin screen will be made in another MR.
See merge request !3744
