Check permissions when sharing project with group
## Summary
Unprivileged user was able to share project with group he didn't have access to, and therefore gain partial access to that group, which opened possibilities for further actions like listing private projects in that group.
See https://gitlab.com/gitlab-org/gitlab-ce/issues/15330
## Fix
This change introduces additional check for group read access.
## Further work
We can think about preventing such problems in the future (this is quite common problem) by moving permissions checks to another layer of abstraction (TBD).
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15330
See merge request !1949
Signed-off-by: Rémy Coutable <remy@rymai.me>
Return status code 303 after a branch DELETE operation to avoid project deletion
Closes#14994
See merge request !3583
Signed-off-by: Rémy Coutable <remy@rymai.me>
Fix Raw / Rendered diff producing different results on merge requests
The raw diff endpoint (`merge_requests/####.diff`) produces a diff based on `target_branch` instead of the original branching point. Same is valid for `merge_requests/####.patch`.
Fixes#14680, #3017
See merge request !3450
Signed-off-by: Rémy Coutable <remy@rymai.me>
Soft delete issuables
Fixes#2489
What still needs to happen: research on the indexes, the gem suggests a [lot of changes](https://github.com/rubysherpas/paranoia#about-indexes) though this is probably a good idea to discuss and I'm unsure on the impact of an omnibus upgrade as I suspect creating about 10 new indexes has a large impact on the downtime.
TODO:
- [x] Also group owners can ***soft*** delete
- [x] Button should be hidden
See merge request !2982
Improve performance of viewing individual issues
This MR does two things:
1. `Issue#related_branches` no longer performs Git operations that aren't needed
2. The output of `Repository#exists?` is now cached and flushed properly
Combined these two changes should further cut down the amount of Git operations performed when viewing individual issues (and possibly other pages).
See merge request !3296
Safari 9.0 does not yet honor the HTML5 `origin-when-cross-origin` mode,
and it's possible load balancers/proxies strip the HTTP_REFERER from
the request header. In these cases, default to some default path.
Closes#3122
Closes https://github.com/gitlabhq/gitlabhq/issues/9731
Change "+" icon under "Files" section to have three options:
* Create file
* Upload file
* New directory
Upload file is no longer accessible from the "Create file" page.
Users can now select a target branch in upload file as well.
Closes#2799: Fixes a bug where file modes were overwritten after a commit
Closes https://github.com/gitlabhq/gitlabhq/issues/8253: Existing files
can no longer be overwritten in the "Create file" section.
Closes#2557
Douwe MaanandRémy Coutable
Robert SpeicherandRémy Coutable
Zeger-Jan van de Weg
Zeger-Jan van de WegandZeger-Jan van de Weg
Jacob Vosmaer
Rubén Dávila
Douglas Barbosa Alexandre
Marin Jankovski
Stan Hu
Minsik Yoonand윤민식
Valery Sizov
Francesco Levorato