Updated breakpoint for sidebar pinning
Updates the breakpoint for sidebar pinning to 1024px.
Think we will have the same issue as before when picking into stable with `$window` not being defined.
See merge request !5019
(cherry picked from commit c5d164d1df)
Expiry date on pinned nav cookie
Adds an expiry date far into the future for the pinned nav cookie so that it survives logout & browser closing.
See merge request !5009
(cherry picked from commit 73196fbd65)
Handle external issues in IssueReferenceFilter
Rendering issue references such as `#1` was broken for projects using an external issues tracker.
See gitlab-org/gitlab-ce#19036
See merge request !4988
(cherry picked from commit 6e82c0e06e)
Fix restore warning message
## What does this MR do?
Fix the restore Rake task so it properly outputs the database warning. This is a pretty important warning and it was not even being output. After this fix, the output looks like the screenshot below.
See merge request !4980
(cherry picked from commit 0144dce7ee)
Fixed comit avatar alignment
## What does this MR do?
Fixes the alignment of the avatar on https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG
Also fixes potential issues in other places.
## Screenshots (if relevant)
See merge request !4933
(cherry picked from commit 8cada02d49)
Fixed URL on label button when filtering
## What does this MR do?
Gives the filtered labels the correct URL. Previously they tried to link to `labels#show` whereas now it links to the correct filter path.
## What are the relevant issue numbers?
Closes#19005
See merge request !4897
(cherry picked from commit d3d9df5a10)
File Browser navigation fixes
Fixes a double request being made when clicking the file name when navigating through file browser and also fixes opening a file in a new tab or when doing ctrl + click.
Closes#19050
**Before**
**After**
See merge request !4891
(cherry picked from commit b32a6add8f)
Resolve "Sub nav isn't showing on file view"
## What does this MR do?
Adds subnav to `Repository` > `File` view
## What are the relevant issue numbers?
Closes#19003
Part of #18844
## Screenshots (if relevant)
cc @dzaporozhets
See merge request !4890
(cherry picked from commit 2efee5f641)
Fixed search field blur not removing focus
## What does this MR do?
Adds a blur event to remove focus styling from the search input.
Any particular reason we were looking for clicks on the document? I can't see why we would be.
## What are the relevant issue numbers?
Closes#18670
## Screenshots (if relevant)
See merge request !4704
(cherry picked from commit c051630aa8)
Ensure logged-out users can't see private refs
https://gitlab.com/gitlab-org/gitlab-ce/issues/18033
I'm still not sure what to do about the CHANGELOG on security issues - should I add to a patch release? This issue was assigned to 8.10.
See merge request !1974
(cherry picked from commit 3a6ebb1fd6)
Fix privilege escalation issue with OAuth external users
Related to https://gitlab.com/gitlab-org/gitlab-ce/issues/19312
This MR fixes a privilege escalation issue, where manually set external users would be reverted back to internal users if they logged in via OAuth and that provider was not in the `external_providers` list.
/cc @douwe
See merge request !1975
(cherry picked from commit 5e6342b7ac)
Fixes missing avatar on system notes
Closes#17295
See merge request !4954
(cherry picked from commit 9e8fdead17)
Removed fade when filtering results
## What does this MR do?
Removes the `opacity` change when filtering results seeing as we now do `Turbolinks.visit` it isn't required.
Best way to see issue - filter issues & then go back. Will still have opacity styling.
See merge request !4932
(cherry picked from commit bef4294c58)
Fixed avatar alignment in new MR view
## What does this MR do?
Fixes the alignment of the avatar in new MR view.
Closes#19076
## Screenshots (if relevant)
See merge request !4901
(cherry picked from commit 3611ee5663)
Fix encrypted data backwards compatibility after upgrading attr_encrypted gem
Adds missing attribute to attr_encrypted so it is fully backwards-compatible. Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/19073
See merge request !4963
(cherry picked from commit 2c3f3cb392)
Resolve "Pin should show up at 1280px min"
Decreased window min width for pinned sidebar
Closes #19171
Part of #19200
See merge request !4947
(cherry picked from commit bbbd0e6c81)
Switched mobile button icons to ellipsis and angle
## What does this MR do?
Switches the mobile button icons
## What are the relevant issue numbers?
Closes#19170
Part of #19200
## Screenshots (if relevant)
See merge request !4944
(cherry picked from commit abc6004fae)
Better debugging for memory killer middleware
This adds more info to the warning messages output by `MemoryKiller`.
Previously only the PID was showed, making it difficult to debug issues like https://gitlab.com/gitlab-org/gitlab-ce/issues/19124
This adds the worker class and job ID to the log messages.
See merge request !4936
(cherry picked from commit 3659992cd5)
Remove duplicate new page btn from edit wiki
## What does this MR do?
Removes duplicate button on wiki page
## What are the relevant issue numbers?
Closes#19075
## Screenshots (if relevant)
See merge request !4904
(cherry picked from commit 121c5c837f)
Use clock_gettime for all performance timestamps
This MR adjusts the performance monitoring code to use `Process.clock_gettime` (thus `clock_gettime(3)`) instead of `Time.now`.
Using `Time.now` / `Time.new` adds more overhead than `Process.clock_gettime`, it also doesn't provide a way of getting timestamps in nanoseconds (which `Process.clock_gettime` does allow).
See merge request !4899
(cherry picked from commit 53ad9522c4)
Update omniauth-saml to 1.6.0 to address a security vulnerability in ruby-saml
## What does this MR do?
Updates `omniauth-saml` to bring in the new `ruby-saml` dependency that addresses [CVE-2016-5697](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5697)
Fixes#19206
See merge request !4951
Fix an information disclosure when requesting access to a group containing private projects
Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/19102.
The commit speaks for itself:
Fix an information disclosure when requesting access to a group containing private projects
The issue was with the `User#groups` and `User#projects` associations
which goes through the `User#group_members` and `User#project_members`.
Initially I chose to use a secure approach by storing the requester's
user ID in `Member#created_by_id` instead of `Member#user_id` because I
was aware that there was a security risk since I didn't know the
codebase well enough.
Then during the review, we decided to change that and directly store the
requester's user ID into `Member#user_id` (for the sake of simplifying
the code I believe), meaning that every `group_members` / `project_members`
association would include the requesters by default...
My bad for not checking that all the `group_members` / `project_members`
associations and the ones that go through them (e.g. `Group#users` and
`Project#users`) were made safe with the `where(requested_at: nil)` /
`where(members: { requested_at: nil })` scopes.
Now they are all secure.
See merge request !1973
Add SMTP as default delivery method to match gitlab-org/omnibus-gitlab!826
Something happened after upgrading to 8.9RC5 that caused mail settings to be set to sendmail by default. gitlab-com/infrastructure#128 describes the issue in more detail. This MR mirrors the change in omnibus with gitlab-org/omnibus-gitlab!826.
Closes#19132
See merge request !4915
Fix a wrong MR status when merge_when_build_succeeds & project.only_allow_merge_if_build_succeeds are true
## What does this MR do?
Fix a wrong MR status when merge_when_build_succeeds & project.only_allow_merge_if_build_succeeds are true.
## Are there points in the code the reviewer needs to double check?
@stanhu I reused your proposal from the issue, I think it's a good enough solution.
## What are the relevant issue numbers?
Fixes#19035.
## Does this MR meet the acceptance criteria?
- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- Tests
- [x] Added for this feature/bug
- [ ] All builds are passing
- [ ] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)
See merge request !4912
Fix temp file being deleted after the request while importing a GitLab project
Fixes https://gitlab.com/gitlab-com/infrastructure/issues/151
In production, the temporary uploaded file is getting deleted straight after the request so the Sidekiq worker is unable to find it in `/tmp`
Also, improved erroring/logging of this situation.
See merge request !4894
Resolve "Scrolling horz on iOS for the secondary nav is broken"
## What does this MR do?
Moves absolutely positioned `div`s outside of the scrolling container because mobile safari causes those elements to jump around on scroll.
## Are there points in the code the reviewer needs to double check?
Check on a real iPhone (was only able to check in iOS simulator)
## Why was this MR needed?
Mobile Safari.
## What are the relevant issue numbers?
Closes#18438
## Screenshots (if relevant)
See merge request !4869
