prevent potential XSS when editing comment

See merge request gitlab/gitlabhq!2238

(cherry picked from commit 80ed6d25a46c0f70ec8baea78b5777118d63876c)

7480e462 prevent potential XSS when editing comment

Prevent creating issues through API without having permissions

See merge request gitlab/gitlabhq!2225

(cherry picked from commit c298bbaa88883343dc9cbbb6abec0808fb3b546c)

915b97c5 Prevent creating issues through API without having permissions

[10.2] Ensure we expose group projects using GroupProjectsFinder

See merge request gitlab/gitlabhq!2234

(cherry picked from commit 072f8f2fd6ec794645375a16ca4ddc1cbeb76d7a)

a2240338 Ensure we expose group projects using GroupProjectsFinder

(10.2) Avoid partial partial email adresses for matching

See merge request gitlab/gitlabhq!2232

(cherry picked from commit 081aa1e91a777c9acb31be4a1e76b3dd7032fa9a)

There are unresolved conflicts in app/models/user.rb.

fa85a3fd Don't allow searching for partial user emails

Fixes project visibility guidelines

See merge request gitlab/gitlabhq!2226

(cherry picked from commit 877c42c0aaf3298d6001614c9706bc366ae4014c)

e4fd1c26 Ensure project wiki visibility guidelines are met

Move the "Limit conflicts with EE" doc to "Automatic CE-> EE merge"

See merge request gitlab-org/gitlab-ce!15749

Allow git pull/push on project redirects

Closes #35385

See merge request gitlab-org/gitlab-ce!15670

Resolve "Deploy markers should be more verbose"

Closes #38032

See merge request gitlab-org/gitlab-ce!15641

Resolve "Include asset_sync gem"

Closes #40031

See merge request gitlab-org/gitlab-ce!15734

Fix N+1 query when displaying events

See merge request gitlab-org/gitlab-ce!15788

Use prefix for TableOfContents filter hrefs

Closes #38473

See merge request gitlab-org/gitlab-ce!15806

Fix invalid pipeline build chain tag evaluation

Closes #40944

See merge request gitlab-org/gitlab-ce!15805

TableOfContents filter generates hrefs for each header in markdown,
if the header text consists from digits and redacted symbols only,
e.g. "123" or "1.0 then the auto-generated href has the same format
as issue references.

If the generated id contains only digits, then 'anchor-' prefix is
prepended to the id.

Closes #38473

Merge branch '29483-no-feedback-when-checking-on-checklist-if-potential-spam-was-detected' into 'master'

Resolve "No feedback when checking on checklist if potential spam was detected"

Closes #29483

See merge request gitlab-org/gitlab-ce!15408

When displaying events we would load the target of those events, then
render the entire data using our Markdown pipeline. This pipeline would
eventually request the author of every target, leading to an additional
query being executed for every target to get the author.

To fix this we now eager load the author of the event's target. In my
local environment this reduces the number of queries to display a
project's Atom feed from 40 to 24 queries.

See https://gitlab.com/gitlab-org/gitlab-ce/issues/36878 for more
information.

Add docs explaining why you get signed out with "Remember me" checked

See merge request gitlab-org/gitlab-ce!15756

See https://gitlab.slack.com/archives/C101F3796/p1512486640000434

Check NFS mounts in a separate process

Closes #39847

See merge request gitlab-org/gitlab-ce!15426

Moving the check out of the general requests, makes sure we don't have
any slowdown in the regular requests.

To keep the process performing this checks small, the check is still
performed inside a unicorn. But that is called from a process running
on the same server.

Because the checks are now done outside normal request, we can have a
simpler failure strategy:

The check is now performed in the background every
`circuitbreaker_check_interval`. Failures are logged in redis. The
failures are reset when the check succeeds. Per check we will try
`circuitbreaker_access_retries` times within
`circuitbreaker_storage_timeout` seconds.

When the number of failures exceeds
`circuitbreaker_failure_count_threshold`, we will block access to the
storage.

After `failure_reset_time` of no checks, we will clear the stored
failures. This could happen when the process that performs the checks
is not running.

Fix new personal access token showing up in a flash message

Closes #40754

See merge request gitlab-org/gitlab-ce!15707

Clean test path between merge request handler tests

Closes #40900

See merge request gitlab-org/gitlab-ce!15792

Migrate Git::Repository#fsck to Gitaly

Closes gitaly#795

See merge request gitlab-org/gitlab-ce!15731

Use relative _path helper URLs in the GitLab UI

Closes #40825

See merge request gitlab-org/gitlab-ce!15738

Replace absolute URLs on related branches/MRs with relative url to avoid hostname

Closes #40555

See merge request gitlab-org/gitlab-ce!15735

Fix loading branches list on cherry pick modal after merge.

Closes #33894

See merge request gitlab-org/gitlab-ce!15306

Add documentation about using US-English

Closes #40675

See merge request gitlab-org/gitlab-ce!15656

Fix transient error in pikadayToString

Closes #40858

See merge request gitlab-org/gitlab-ce!15754