Merge remote-tracking branch 'upstream/master' into ce-to-ee-2018-07-18

# Conflicts:
#	app/assets/stylesheets/framework/variables.scss
#	locale/gitlab.pot

[ci skip]

app/assets/javascripts/diffs/components/app.vue

@@ -85,6 +85,9 @@ export default {
       }
       return __('Show latest version');
     },
+    canCurrentUserFork() {
+      return this.currentUser.canFork === true && this.currentUser.canCreateMergeRequest;
+    },
   },
   watch: {
     diffViewType() {
@@ -192,7 +195,7 @@ export default {
           v-for="file in diffFiles"
           :key="file.newPath"
           :file="file"
-          :current-user="currentUser"
+          :can-current-user-fork="canCurrentUserFork"
         />
       </div>
       <no-changes v-else />

app/assets/javascripts/diffs/components/diff_file.vue

@@ -18,8 +18,8 @@ export default {
       type: Object,
       required: true,
     },
-    currentUser: {
-      type: Object,
+    canCurrentUserFork: {
+      type: Boolean,
       required: true,
     },
   },
@@ -87,7 +87,7 @@ export default {
     class="diff-file file-holder"
   >
     <diff-file-header
-      :current-user="currentUser"
+      :can-current-user-fork="canCurrentUserFork"
       :diff-file="file"
       :collapsible="true"
       :expanded="!isCollapsed"

app/assets/javascripts/diffs/components/diff_file_header.vue

@@ -39,8 +39,8 @@ export default {
       required: false,
       default: true,
     },
-    currentUser: {
-      type: Object,
+    canCurrentUserFork: {
+      type: Boolean,
       required: true,
     },
   },
@@ -228,7 +228,7 @@ export default {
 
         <edit-button
           v-if="!diffFile.deletedFile"
-          :current-user="currentUser"
+          :can-current-user-fork="canCurrentUserFork"
           :edit-path="diffFile.editPath"
           :can-modify-blob="diffFile.canModifyBlob"
           @showForkMessage="showForkMessage"

app/assets/javascripts/diffs/components/diff_line_note_form.vue

@@ -13,12 +13,8 @@ export default {
     noteForm,
   },
   props: {
-    diffFile: {
-      type: Object,
-      required: true,
-    },
-    diffLines: {
-      type: Array,
+    diffFileHash: {
+      type: String,
       required: true,
     },
     line: {
@@ -40,6 +36,7 @@ export default {
       noteableData: state => state.notes.noteableData,
       diffViewType: state => state.diffs.diffViewType,
     }),
+    ...mapGetters('diffs', ['getDiffFileByHash']),
     ...mapGetters(['isLoggedIn', 'noteableType', 'getNoteableData', 'getNotesDataByProp']),
   },
   mounted() {
@@ -68,13 +65,14 @@ export default {
       });
     },
     handleSaveNote(note) {
+      const selectedDiffFile = this.getDiffFileByHash(this.diffFileHash);
       const postData = getNoteFormData({
         note,
         noteableData: this.noteableData,
         noteableType: this.noteableType,
         noteTargetLine: this.noteTargetLine,
         diffViewType: this.diffViewType,
-        diffFile: this.diffFile,
+        diffFile: selectedDiffFile,
         linePosition: this.position,
       });
 

app/assets/javascripts/diffs/components/diff_table_cell.vue

@@ -24,8 +24,12 @@ export default {
       type: Object,
       required: true,
     },
-    diffFile: {
-      type: Object,
+    fileHash: {
+      type: String,
+      required: true,
+    },
+    contextLinesPath: {
+      type: String,
       required: true,
     },
     diffViewType: {
@@ -120,14 +124,14 @@ export default {
     :class="classNameMap"
   >
     <diff-line-gutter-content
-      :file-hash="diffFile.fileHash"
+      :file-hash="fileHash"
+      :context-lines-path="contextLinesPath"
       :line-type="normalizedLine.type"
       :line-code="normalizedLine.lineCode"
       :line-position="linePosition"
       :line-number="lineNumber"
       :meta-data="normalizedLine.metaData"
       :show-comment-button="showCommentButton"
-      :context-lines-path="diffFile.contextLinesPath"
       :is-bottom="isBottom"
       :is-match-line="isMatchLine"
       :is-context-line="isContentLine"

app/assets/javascripts/diffs/components/edit_button.vue

@@ -5,8 +5,8 @@ export default {
       type: String,
       required: true,
     },
-    currentUser: {
-      type: Object,
+    canCurrentUserFork: {
+      type: Boolean,
       required: true,
     },
     canModifyBlob: {
@@ -17,12 +17,12 @@ export default {
   },
   methods: {
     handleEditClick(evt) {
-      if (!this.currentUser || this.canModifyBlob) {
+      if (!this.canCurrentUserFork || this.canModifyBlob) {
         // if we can Edit, do default Edit button behavior
         return;
       }
 
-      if (this.currentUser.canFork && this.currentUser.canCreateMergeRequest) {
+      if (this.canCurrentUserFork) {
         evt.preventDefault();
         this.$emit('showForkMessage');
       }

app/assets/javascripts/diffs/components/inline_diff_comment_row.vue

@@ -13,12 +13,8 @@ export default {
       type: Object,
       required: true,
     },
-    diffFile: {
-      type: Object,
-      required: true,
-    },
-    diffLines: {
-      type: Array,
+    diffFileHash: {
+      type: String,
       required: true,
     },
     lineIndex: {
@@ -58,10 +54,9 @@ export default {
         />
         <diff-line-note-form
           v-if="diffLineCommentForms[line.lineCode]"
-          :diff-file="diffFile"
-          :diff-lines="diffLines"
+          :diff-file-hash="diffFileHash"
           :line="line"
-          :note-target-line="diffLines[lineIndex]"
+          :note-target-line="line"
         />
       </div>
     </td>

app/assets/javascripts/diffs/components/inline_diff_table_row.vue

@@ -16,8 +16,12 @@ export default {
     DiffTableCell,
   },
   props: {
-    diffFile: {
-      type: Object,
+    fileHash: {
+      type: String,
+      required: true,
+    },
+    contextLinesPath: {
+      type: String,
       required: true,
     },
     line: {
@@ -50,7 +54,7 @@ export default {
     inlineRowId() {
       const { lineCode, oldLine, newLine } = this.line;
 
-      return lineCode || `${this.diffFile.fileHash}_${oldLine}_${newLine}`;
+      return lineCode || `${this.fileHash}_${oldLine}_${newLine}`;
     },
   },
   created() {
@@ -78,7 +82,8 @@ export default {
     @mouseout="handleMouseMove"
   >
     <diff-table-cell
-      :diff-file="diffFile"
+      :file-hash="fileHash"
+      :context-lines-path="contextLinesPath"
       :line="line"
       :line-type="oldLineType"
       :is-bottom="isBottom"
@@ -87,7 +92,8 @@ export default {
       class="diff-line-num old_line"
     />
     <diff-table-cell
-      :diff-file="diffFile"
+      :file-hash="fileHash"
+      :context-lines-path="contextLinesPath"
       :line="line"
       :line-type="newLineType"
       :is-bottom="isBottom"

app/assets/javascripts/diffs/components/inline_diff_view.vue

@@ -60,15 +60,15 @@ export default {
         v-for="(line, index) in normalizedDiffLines"
       >
         <inline-diff-table-row
-          :diff-file="diffFile"
+          :file-hash="diffFile.fileHash"
+          :context-lines-path="diffFile.contextLinesPath"
           :line="line"
           :is-bottom="index + 1 === diffLinesLength"
           :key="line.lineCode"
         />
         <inline-diff-comment-row
           v-if="shouldRenderCommentRow(line)"
-          :diff-file="diffFile"
-          :diff-lines="normalizedDiffLines"
+          :diff-file-hash="diffFile.fileHash"
           :line="line"
           :line-index="index"
           :key="index"

app/assets/javascripts/diffs/components/parallel_diff_comment_row.vue

@@ -13,12 +13,8 @@ export default {
       type: Object,
       required: true,
     },
-    diffFile: {
-      type: Object,
-      required: true,
-    },
-    diffLines: {
-      type: Array,
+    diffFileHash: {
+      type: String,
       required: true,
     },
     lineIndex: {
@@ -91,10 +87,9 @@ export default {
       <diff-line-note-form
         v-if="diffLineCommentForms[leftLineCode] &&
         diffLineCommentForms[leftLineCode]"
-        :diff-file="diffFile"
-        :diff-lines="diffLines"
+        :diff-file-hash="diffFileHash"
         :line="line.left"
-        :note-target-line="diffLines[lineIndex].left"
+        :note-target-line="line.left"
         position="left"
       />
     </td>
@@ -112,10 +107,9 @@ export default {
       <diff-line-note-form
         v-if="diffLineCommentForms[rightLineCode] &&
         diffLineCommentForms[rightLineCode] && line.right.type"
-        :diff-file="diffFile"
-        :diff-lines="diffLines"
+        :diff-file-hash="diffFileHash"
         :line="line.right"
-        :note-target-line="diffLines[lineIndex].right"
+        :note-target-line="line.right"
         position="right"
       />
     </td>

app/assets/javascripts/diffs/components/parallel_diff_table_row.vue

@@ -19,8 +19,12 @@ export default {
     DiffTableCell,
   },
   props: {
-    diffFile: {
-      type: Object,
+    fileHash: {
+      type: String,
+      required: true,
+    },
+    contextLinesPath: {
+      type: String,
       required: true,
     },
     line: {
@@ -103,7 +107,8 @@ export default {
     @mouseout="handleMouseMove"
   >
     <diff-table-cell
-      :diff-file="diffFile"
+      :file-hash="fileHash"
+      :context-lines-path="contextLinesPath"
       :line="line"
       :line-type="oldLineType"
       :line-position="linePositionLeft"
@@ -123,7 +128,8 @@ export default {
     >
     </td>
     <diff-table-cell
-      :diff-file="diffFile"
+      :file-hash="fileHash"
+      :context-lines-path="contextLinesPath"
       :line="line"
       :line-type="newLineType"
       :line-position="linePositionRight"

app/assets/javascripts/diffs/components/parallel_diff_view.vue

@@ -93,17 +93,17 @@ export default {
           v-for="(line, index) in parallelDiffLines"
         >
           <parallel-diff-table-row
-            :diff-file="diffFile"
+            :file-hash="diffFile.fileHash"
+            :context-lines-path="diffFile.contextLinesPath"
             :line="line"
             :is-bottom="index + 1 === diffLinesLength"
             :key="index"
           />
           <parallel-diff-comment-row
             v-if="shouldRenderCommentRow(line)"
-            :key="line.left.lineCode || line.right.lineCode"
+            :key="`dcr-${index}`"
             :line="line"
-            :diff-file="diffFile"
-            :diff-lines="parallelDiffLines"
+            :diff-file-hash="diffFile.fileHash"
             :line-index="index"
           />
         </template>

app/assets/javascripts/diffs/store/getters.js

@@ -57,4 +57,8 @@ export const getDiffFileDiscussions = (state, getters, rootState, rootGetters) =
   ) || [];
 
 // prevent babel-plugin-rewire from generating an invalid default during karma∂ tests
+export const getDiffFileByHash = state => fileHash =>
+  state.diffFiles.find(file => file.fileHash === fileHash);
+
+// prevent babel-plugin-rewire from generating an invalid default during karma tests
 export default () => {};

app/assets/javascripts/ide/components/new_dropdown/button.vue

@@ -38,6 +38,7 @@ export default {
   <button
     :aria-label="label"
     type="button"
+    class="btn-blank"
     @click.stop.prevent="clicked"
   >
     <icon

app/assets/javascripts/monitoring/stores/monitoring_store.js

 import _ from 'underscore';
 
 function sortMetrics(metrics) {
-  return _.chain(metrics).sortBy('title').sortBy('weight').value();
+  return _.chain(metrics)
+    .sortBy('title')
+    .sortBy('weight')
+    .value();
 }
 
 function normalizeMetrics(metrics) {
@@ -39,7 +42,9 @@ export default class MonitoringStore {
   }
 
   storeEnvironmentsData(environmentsData = []) {
-    this.environmentsData = environmentsData;
+    this.environmentsData = environmentsData.filter(
+      environment => !!environment.latest.last_deployment,
+    );
   }
 
   getMetricsCount() {

app/assets/javascripts/notes/components/diff_with_note.vue

 <script>
-  import { mapState, mapActions } from 'vuex';
-  import imageDiffHelper from '~/image_diff/helpers/index';
-  import { convertObjectPropsToCamelCase } from '~/lib/utils/common_utils';
-  import DiffFileHeader from '~/diffs/components/diff_file_header.vue';
-  import SkeletonLoadingContainer from '~/vue_shared/components/skeleton_loading_container.vue';
-  import { trimFirstCharOfLineContent } from '~/diffs/store/utils';
+import { mapState, mapActions } from 'vuex';
+import imageDiffHelper from '~/image_diff/helpers/index';
+import { convertObjectPropsToCamelCase } from '~/lib/utils/common_utils';
+import DiffFileHeader from '~/diffs/components/diff_file_header.vue';
+import SkeletonLoadingContainer from '~/vue_shared/components/skeleton_loading_container.vue';
+import { trimFirstCharOfLineContent } from '~/diffs/store/utils';
 
-  export default {
+export default {
   components: {
     DiffFileHeader,
     SkeletonLoadingContainer,
@@ -27,8 +27,7 @@
       noteableData: state => state.notes.noteableData,
     }),
     hasTruncatedDiffLines() {
-        return this.discussion.truncatedDiffLines &&
-          this.discussion.truncatedDiffLines.length !== 0;
+      return this.discussion.truncatedDiffLines && this.discussion.truncatedDiffLines.length !== 0;
     },
     isDiscussionsExpanded() {
       return true; // TODO: @fatihacet - Fix this.
@@ -49,9 +48,6 @@
     imageDiffHtml() {
       return this.discussion.imageDiffHtml;
     },
-      currentUser() {
-        return this.noteableData.current_user;
-      },
     userColorScheme() {
       return window.gon.user_color_scheme;
     },
@@ -88,7 +84,7 @@
         });
     },
   },
-  };
+};
 </script>
 
 <template>
@@ -99,7 +95,7 @@
   >
     <diff-file-header
       :diff-file="diffFile"
-      :current-user="currentUser"
+      :can-current-user-fork="false"
       :discussions-expanded="isDiscussionsExpanded"
       :expanded="!isCollapsed"
     />

app/assets/stylesheets/framework/variables.scss

@@ -302,10 +302,13 @@ $system-footer-height: $system-header-height;
 $flash-height: 52px;
 $context-header-height: 60px;
 $breadcrumb-min-height: 48px;
+<<<<<<< HEAD
 
 $issue-box-upcoming-bg: #8f8f8f;
 $pages-group-name-color: #4c4e54;
 $ldap-members-override-bg: $orange-50;
+=======
+>>>>>>> upstream/master
 
 /*
 * Common component specific colors

app/assets/stylesheets/pages/merge_requests.scss

@@ -551,6 +551,7 @@
     @include media-breakpoint-up(lg) {
       .branch-actions {
         align-self: center;
+        margin-left: $gl-padding;
       }
     }
   }

app/models/note.rb

@@ -210,7 +210,7 @@ class Note < ActiveRecord::Base
   end
 
   def hook_attrs
-    attributes
+    Gitlab::HookData::NoteBuilder.new(self).build
   end
 
   def for_commit?

app/models/wiki_page.rb

@@ -60,7 +60,7 @@ class WikiPage
   attr_accessor :attributes
 
   def hook_attrs
-    attributes
+    Gitlab::HookData::WikiPageBuilder.new(self).build
   end
 
   def initialize(wiki, page = nil, persisted = false)

app/services/application_settings/base_service.rb

+# frozen_string_literal: true
+
 module ApplicationSettings
   class BaseService < ::BaseService
     def initialize(application_setting, user, params = {})

app/services/application_settings/update_service.rb

+# frozen_string_literal: true
+
 module ApplicationSettings
   class UpdateService < ApplicationSettings::BaseService
     prepend EE::ApplicationSettings::UpdateService

app/services/applications/create_service.rb

+# frozen_string_literal: true
+
 module Applications
   class CreateService
     prepend ::EE::Applications::CreateService

app/services/auth/container_registry_authentication_service.rb

+# frozen_string_literal: true
+
 module Auth
   class ContainerRegistryAuthenticationService < BaseService
     AUDIENCE = 'container_registry'.freeze

app/services/badges/base_service.rb

+# frozen_string_literal: true
+
 module Badges
   class BaseService
     protected

app/services/badges/build_service.rb

+# frozen_string_literal: true
+
 module Badges
   class BuildService < Badges::BaseService
     # returns the created badge

app/services/badges/create_service.rb

+# frozen_string_literal: true
+
 module Badges
   class CreateService < Badges::BaseService
     # returns the created badge

app/services/badges/update_service.rb

+# frozen_string_literal: true
+
 module Badges
   class UpdateService < Badges::BaseService
     # returns the updated badge

app/services/boards/base_service.rb

+# frozen_string_literal: true
+
 module Boards
   class BaseService < ::BaseService
     prepend EE::Boards::BaseService

app/services/boards/create_service.rb

+# frozen_string_literal: true
+
 module Boards
   class CreateService < Boards::BaseService
     prepend EE::Boards::CreateService

app/services/boards/issues/create_service.rb

+# frozen_string_literal: true
+
 module Boards
   module Issues
     class CreateService < Boards::BaseService

app/services/boards/issues/list_service.rb

+# frozen_string_literal: true
+
 module Boards
   module Issues
     class ListService < Boards::BaseService

app/services/boards/issues/move_service.rb

+# frozen_string_literal: true
+
 module Boards
   module Issues
     class MoveService < Boards::BaseService

app/services/boards/list_service.rb

+# frozen_string_literal: true
+
 module Boards
   class ListService < Boards::BaseService
     prepend EE::Boards::ListService

app/services/boards/lists/create_service.rb

+# frozen_string_literal: true
+
 module Boards
   module Lists
     class CreateService < Boards::BaseService

app/services/boards/lists/destroy_service.rb

+# frozen_string_literal: true
+
 module Boards
   module Lists
     class DestroyService < Boards::BaseService

app/services/boards/lists/generate_service.rb

+# frozen_string_literal: true
+
 module Boards
   module Lists
     class GenerateService < Boards::BaseService

app/services/boards/lists/list_service.rb

+# frozen_string_literal: true
+
 module Boards
   module Lists
     class ListService < Boards::BaseService

app/services/boards/lists/move_service.rb

+# frozen_string_literal: true
+
 module Boards
   module Lists
     class MoveService < Boards::BaseService

app/services/chat_names/authorize_user_service.rb

+# frozen_string_literal: true
+
 module ChatNames
   class AuthorizeUserService
     include Gitlab::Routing

app/services/chat_names/find_user_service.rb

+# frozen_string_literal: true
+
 module ChatNames
   class FindUserService
     def initialize(service, params)

app/services/ci/create_pipeline_schedule_service.rb

+# frozen_string_literal: true
+
 module Ci
   class CreatePipelineScheduleService < BaseService
     def execute

app/services/ci/create_pipeline_service.rb

+# frozen_string_literal: true
+
 module Ci
   class CreatePipelineService < BaseService
     attr_reader :pipeline

app/services/ci/ensure_stage_service.rb

+# frozen_string_literal: true
+
 module Ci
   ##
   # We call this service everytime we persist a CI/CD job.

app/services/ci/extract_sections_from_build_trace_service.rb

+# frozen_string_literal: true
+
 module Ci
   class ExtractSectionsFromBuildTraceService < BaseService
     def execute(build)

app/services/ci/fetch_kubernetes_token_service.rb

+# frozen_string_literal: true
+
 ##
 # TODO:
 # Almost components in this class were copied from app/models/project_services/kubernetes_service.rb

app/services/ci/pipeline_trigger_service.rb

+# frozen_string_literal: true
+
 module Ci
   class PipelineTriggerService < BaseService
     include Gitlab::Utils::StrongMemoize

app/services/ci/play_build_service.rb

+# frozen_string_literal: true
+
 module Ci
   class PlayBuildService < ::BaseService
     def execute(build)

app/services/ci/process_pipeline_service.rb

+# frozen_string_literal: true
+
 module Ci
   class ProcessPipelineService < BaseService
     attr_reader :pipeline

app/services/ci/register_job_service.rb

+# frozen_string_literal: true
+
 module Ci
   # This class responsible for assigning
   # proper pending build to runner on runner API request

app/services/ci/retry_build_service.rb

+# frozen_string_literal: true
+
 module Ci
   class RetryBuildService < ::BaseService
     CLONE_ACCESSORS = %i[pipeline project ref tag options commands name

app/services/ci/retry_pipeline_service.rb

+# frozen_string_literal: true
+
 module Ci
   class RetryPipelineService < ::BaseService
     include Gitlab::OptimisticLocking

app/services/ci/stop_environments_service.rb

+# frozen_string_literal: true
+
 module Ci
   class StopEnvironmentsService < BaseService
     attr_reader :ref

app/services/ci/update_build_queue_service.rb

+# frozen_string_literal: true
+
 module Ci
   class UpdateBuildQueueService
     def execute(build)

app/services/ci/update_runner_service.rb

+# frozen_string_literal: true
+
 module Ci
   class UpdateRunnerService
     attr_reader :runner

app/services/clusters/applications/base_helm_service.rb

+# frozen_string_literal: true
+
 module Clusters
   module Applications
     class BaseHelmService

app/services/clusters/applications/check_ingress_ip_address_service.rb

+# frozen_string_literal: true
+
 module Clusters
   module Applications
     class CheckIngressIpAddressService < BaseHelmService

app/services/clusters/applications/check_installation_progress_service.rb

+# frozen_string_literal: true
+
 module Clusters
   module Applications
     class CheckInstallationProgressService < BaseHelmService

app/services/clusters/applications/install_service.rb

+# frozen_string_literal: true
+
 module Clusters
   module Applications
     class InstallService < BaseHelmService

app/services/clusters/applications/schedule_installation_service.rb

+# frozen_string_literal: true
+
 module Clusters
   module Applications
     class ScheduleInstallationService < ::BaseService

app/services/clusters/create_service.rb

+# frozen_string_literal: true
+
 module Clusters
   class CreateService < BaseService
     prepend EE::Clusters::CreateService

app/services/clusters/gcp/fetch_operation_service.rb

+# frozen_string_literal: true
+
 module Clusters
   module Gcp
     class FetchOperationService

app/services/clusters/gcp/finalize_creation_service.rb

+# frozen_string_literal: true
+
 module Clusters
   module Gcp
     class FinalizeCreationService

app/services/clusters/gcp/provision_service.rb

+# frozen_string_literal: true
+
 module Clusters
   module Gcp
     class ProvisionService

app/services/clusters/gcp/verify_provision_status_service.rb

+# frozen_string_literal: true
+
 module Clusters
   module Gcp
     class VerifyProvisionStatusService

app/services/clusters/update_service.rb

+# frozen_string_literal: true
+
 module Clusters
   class UpdateService < BaseService
     def execute(cluster)

app/services/commits/change_service.rb

+# frozen_string_literal: true
+
 module Commits
   class ChangeService < Commits::CreateService
     def initialize(*args)

app/services/commits/cherry_pick_service.rb

+# frozen_string_literal: true
+
 module Commits
   class CherryPickService < ChangeService
     def create_commit!

app/services/commits/create_service.rb

+# frozen_string_literal: true
+
 module Commits
   class CreateService < ::BaseService
     prepend EE::Commits::CreateService

app/services/commits/revert_service.rb

+# frozen_string_literal: true
+
 module Commits
   class RevertService < ChangeService
     def create_commit!

app/services/concerns/exclusive_lease_guard.rb

+# frozen_string_literal: true
+
 #
 # Concern that helps with getting an exclusive lease for running a block
 # of code.

app/services/concerns/issues/resolve_discussions.rb

+# frozen_string_literal: true
+
 module Issues
   module ResolveDiscussions
     include Gitlab::Utils::StrongMemoize

app/services/concerns/update_visibility_level.rb

+# frozen_string_literal: true
+
 module UpdateVisibilityLevel
   def valid_visibility_level_change?(target, new_visibility)
     # check that user is allowed to set specified visibility_level

app/services/concerns/users/new_user_notifier.rb

+# frozen_string_literal: true
+
 module Users
   module NewUserNotifier
     def notify_new_user(user, reset_token)

app/services/concerns/users/participable_service.rb

+# frozen_string_literal: true
+
 module Users
   module ParticipableService
     extend ActiveSupport::Concern

app/services/deploy_keys/create_service.rb

+# frozen_string_literal: true
+
 module DeployKeys
   class CreateService < Keys::BaseService
     def execute

app/services/deploy_tokens/create_service.rb

+# frozen_string_literal: true
+
 module DeployTokens
   class CreateService < BaseService
     def execute

app/services/discussions/base_service.rb

+# frozen_string_literal: true
+
 module Discussions
   class BaseService < ::BaseService
   end

app/services/discussions/resolve_service.rb

+# frozen_string_literal: true
+
 module Discussions
   class ResolveService < Discussions::BaseService
     def execute(one_or_more_discussions)

app/services/discussions/update_diff_position_service.rb

+# frozen_string_literal: true
+
 module Discussions
   class UpdateDiffPositionService < BaseService
     def execute(discussion)

app/services/emails/base_service.rb

+# frozen_string_literal: true
+
 module Emails
   class BaseService
     def initialize(current_user, params = {})

app/services/emails/confirm_service.rb

+# frozen_string_literal: true
+
 module Emails
   class ConfirmService < ::Emails::BaseService
     def execute(email)

app/services/emails/create_service.rb

+# frozen_string_literal: true
+
 module Emails
   class CreateService < ::Emails::BaseService
     prepend ::EE::Emails::CreateService

app/services/emails/destroy_service.rb

+# frozen_string_literal: true
+
 module Emails
   class DestroyService < ::Emails::BaseService
     prepend ::EE::Emails::DestroyService

app/services/events/render_service.rb

+# frozen_string_literal: true
+
 module Events
   class RenderService < BaseRenderer
     def execute(events, atom_request: false)

app/services/files/base_service.rb

+# frozen_string_literal: true
+
 module Files
   class BaseService < Commits::CreateService
     FileChangedError = Class.new(StandardError)

app/services/files/create_dir_service.rb

+# frozen_string_literal: true
+
 module Files
   class CreateDirService < Files::BaseService
     def create_commit!

app/services/files/create_service.rb

+# frozen_string_literal: true
+
 module Files
   class CreateService < Files::BaseService
     def create_commit!

app/services/files/delete_service.rb

+# frozen_string_literal: true
+
 module Files
   class DeleteService < Files::BaseService
     def create_commit!

app/services/files/multi_service.rb

+# frozen_string_literal: true
+
 module Files
   class MultiService < Files::BaseService
     UPDATE_FILE_ACTIONS = %w(update move delete).freeze

app/services/files/update_service.rb

+# frozen_string_literal: true
+
 module Files
   class UpdateService < Files::BaseService
     def create_commit!

app/services/gpg_keys/create_service.rb

+# frozen_string_literal: true
+
 module GpgKeys
   class CreateService < Keys::BaseService
     def execute

app/services/groups/base_service.rb

+# frozen_string_literal: true
+
 module Groups
   class BaseService < ::BaseService
     attr_accessor :group, :current_user, :params

app/services/groups/create_service.rb

+# frozen_string_literal: true
+
 module Groups
   class CreateService < Groups::BaseService
     prepend ::EE::Groups::CreateService

app/services/groups/destroy_service.rb

+# frozen_string_literal: true
+
 module Groups
   class DestroyService < Groups::BaseService
     prepend ::EE::Groups::DestroyService

app/services/groups/nested_create_service.rb

+# frozen_string_literal: true
+
 module Groups
   class NestedCreateService < Groups::BaseService
     attr_reader :group_path, :visibility_level

app/services/groups/transfer_service.rb

+# frozen_string_literal: true
+
 module Groups
   class TransferService < Groups::BaseService
     ERROR_MESSAGES = {

app/services/groups/update_service.rb

+# frozen_string_literal: true
+
 module Groups
   class UpdateService < Groups::BaseService
     include UpdateVisibilityLevel

app/services/issuable/bulk_update_service.rb

+# frozen_string_literal: true
+
 module Issuable
   class BulkUpdateService < IssuableBaseService
     def execute(type)

app/services/issuable/common_system_notes_service.rb

+# frozen_string_literal: true
+
 module Issuable
   class CommonSystemNotesService < ::BaseService
     prepend EE::Issuable::CommonSystemNotesService

app/services/issuable/destroy_service.rb

+# frozen_string_literal: true
+
 module Issuable
   class DestroyService < IssuableBaseService
     def execute(issuable)

app/services/issues/base_service.rb

+# frozen_string_literal: true
+
 module Issues
   class BaseService < ::IssuableBaseService
     def hook_data(issue, action, old_associations: {})

app/services/issues/build_service.rb

+# frozen_string_literal: true
+
 module Issues
   class BuildService < Issues::BaseService
     include ResolveDiscussions
@@ -45,14 +47,14 @@ module Issues
 
       other_note_count = discussion.notes.size - 1
 
-      discussion_info = "- [ ] #{first_note_to_resolve.author.to_reference} #{action} a [discussion](#{note_url}): "
-      discussion_info << " (+#{other_note_count} #{'comment'.pluralize(other_note_count)})" if other_note_count > 0
+      discussion_info = ["- [ ] #{first_note_to_resolve.author.to_reference} #{action} a [discussion](#{note_url}): "]
+      discussion_info << "(+#{other_note_count} #{'comment'.pluralize(other_note_count)})" if other_note_count > 0
 
       note_without_block_quotes = Banzai::Filter::BlockquoteFenceFilter.new(first_note_to_resolve.note).call
       spaces = ' ' * 4
       quote = note_without_block_quotes.lines.map { |line| "#{spaces}> #{line}" }.join
 
-      [discussion_info, quote].join("\n\n")
+      [discussion_info.join(' '), quote].join("\n\n")
     end
 
     def issue_params

app/services/issues/close_service.rb

+# frozen_string_literal: true
+
 module Issues
   class CloseService < Issues::BaseService
     # Closes the supplied issue if the current user is able to do so.

app/services/issues/create_service.rb

+# frozen_string_literal: true
+
 module Issues
   class CreateService < Issues::BaseService
     include SpamCheckService

app/services/issues/duplicate_service.rb

+# frozen_string_literal: true
+
 module Issues
   class DuplicateService < Issues::BaseService
     def execute(duplicate_issue, canonical_issue)

app/services/issues/fetch_referenced_merge_requests_service.rb

+# frozen_string_literal: true
+
 module Issues
   class FetchReferencedMergeRequestsService < Issues::BaseService
     def execute(issue)

app/services/issues/move_service.rb

+# frozen_string_literal: true
+
 module Issues
   class MoveService < Issues::BaseService
     prepend ::EE::Issues::MoveService

app/services/issues/reopen_service.rb

+# frozen_string_literal: true
+
 module Issues
   class ReopenService < Issues::BaseService
     def execute(issue)

app/services/issues/update_service.rb

+# frozen_string_literal: true
+
 module Issues
   class UpdateService < Issues::BaseService
     include SpamCheckService

app/services/keys/base_service.rb

+# frozen_string_literal: true
+
 module Keys
   class BaseService
     attr_accessor :user, :params

app/services/keys/create_service.rb

+# frozen_string_literal: true
+
 module Keys
   class CreateService < ::Keys::BaseService
     prepend EE::Keys::CreateService

app/services/keys/destroy_service.rb

+# frozen_string_literal: true
+
 module Keys
   class DestroyService < ::Keys::BaseService
     prepend EE::Keys::DestroyService

app/services/keys/last_used_service.rb

+# frozen_string_literal: true
+
 module Keys
   class LastUsedService
     TIMEOUT = 1.day.to_i

app/services/labels/base_service.rb

+# frozen_string_literal: true
+
 module Labels
   class BaseService < ::BaseService
     COLOR_NAME_TO_HEX = {

app/services/labels/create_service.rb

+# frozen_string_literal: true
+
 module Labels
   class CreateService < Labels::BaseService
     def initialize(params = {})

app/services/labels/find_or_create_service.rb

+# frozen_string_literal: true
+
 module Labels
   class FindOrCreateService
     def initialize(current_user, parent, params = {})

app/services/labels/promote_service.rb

+# frozen_string_literal: true
+
 module Labels
   class PromoteService < BaseService
     BATCH_SIZE = 1000

app/services/labels/transfer_service.rb

+# frozen_string_literal: true
+
 # Labels::TransferService class
 #
 # User for recreate the missing group labels at project level

app/services/labels/update_service.rb

+# frozen_string_literal: true
+
 module Labels
   class UpdateService < Labels::BaseService
     def initialize(params = {})

app/views/ci/runner/_how_to_setup_runner.html.haml

-- link = link_to _("GitLab Runner section"), 'https://about.gitlab.com/gitlab-ci/#gitlab-runner', target: '_blank'
+- link = link_to _("Install GitLab Runner"), 'https://docs.gitlab.com/runner/install/', target: '_blank'
 .append-bottom-10
   %h4= _("Setup a #{type} Runner manually")
 
 %ol
   %li
-    = _("Install a Runner compatible with GitLab CI")
-    = (_("(check out the %{link} for information on how to install it).") % { link: link }).html_safe
+    = link.html_safe
   %li
     = _("Specify the following URL during the Runner setup:")
     %code#coordinator_address= root_url(only_path: false)
+    = clipboard_button(target: '#coordinator_address', title: _("Copy URL to clipboard"), class: "btn-transparent btn-clipboard")
   %li
     = _("Use the following registration token during setup:")
     %code#registration_token= registration_token
+    = clipboard_button(target: '#registration_token', title: _("Copy token to clipboard"), class: "btn-transparent btn-clipboard")
   %li
     = _("Start the Runner!")

changelogs/unreleased/add-merge-request-header-branch-details-right-margin.yml

+---
+title: Add merge request header branch actions left margin
+merge_request: 20643
+author: George Tsiolis
+type: changed

changelogs/unreleased/frozen-string-enable-apps-services-inner.yml

+---
+title: Enable frozen string in app/services/**/*.rb
+merge_request: 20656
+author: gfyoung
+type: performance

changelogs/unreleased/satishperala-gitlab-ce-20720_webhooks_full_image_url.yml

+---
+title: Include full image URL in webhooks for uploaded images
+merge_request: 18109
+author: Satish Perala
+type: changed

changelogs/unreleased/sh-fix-issue-49133.yml

+---
+title: Fix symlink vulnerability in project import
+merge_request:
+author:
+type: security

changelogs/unreleased/update-specific-runners-help-url.yml

+---
+title: Update specific runners help URL
+merge_request: 20213
+author: George Tsiolis
+type: other

doc/user/project/integrations/webhooks.md

@@ -10,6 +10,13 @@ Starting from GitLab 8.5:
 Starting from GitLab 11.1, the logs of web hooks are automatically removed after
 one month.
 
+>**Note**
+Starting from GitLab 11.2:
+- The `description` field for issues, merge requests, comments, and wiki pages
+  is rewritten so that simple Markdown image references (like
+  `![](/uploads/...)`) have their target URL changed to an absolute URL. See
+  [image URL rewriting](#image-url-rewriting) for more details.
+
 Project webhooks allow you to trigger a URL if for example new code is pushed or
 a new issue is created. You can configure webhooks to listen for specific events
 like pushes, issues or merge requests. GitLab will send a POST request with data
@@ -1150,6 +1157,27 @@ X-Gitlab-Event: Build Hook
 }
 ```
 
+## Image URL rewriting
+
+From GitLab 11.2, simple image references are rewritten to use an absolute URL
+in webhooks. So if an image, merge request, comment, or wiki page has this in
+its description:
+
+```markdown
+![image](/uploads/$sha/image.png)
+```
+
+It will appear in the webhook body as the below (assuming that GitLab is
+installed at gitlab.example.com):
+
+```markdown
+![image](https://gitlab.example.com/uploads/$sha/image.png)
+```
+
+This will not rewrite URLs that already are pointing to HTTP, HTTPS, or
+protocol-relative URLs. It will also not rewrite image URLs using advanced
+Markdown features, like link labels.
+
 ## Testing webhooks
 
 You can trigger the webhook manually. Sample data from the project will be used.Sample data will take from the project.

lib/banzai/filter/blockquote_fence_filter.rb

@@ -2,27 +2,7 @@ module Banzai
   module Filter
     class BlockquoteFenceFilter < HTML::Pipeline::TextFilter
       REGEX = %r{
-          (?<code>
-            # Code blocks:
-            # ```
-            # Anything, including `>>>` blocks which are ignored by this filter
-            # ```
-
-            ^```
-            .+?
-            \n```\ *$
-          )
-        |
-          (?<html>
-            # HTML block:
-            # <tag>
-            # Anything, including `>>>` blocks which are ignored by this filter
-            # </tag>
-
-            ^<[^>]+?>\ *\n
-            .+?
-            \n<\/[^>]+?>\ *$
-          )
+          #{::Gitlab::Regex.markdown_code_or_html_blocks}
         |
           (?:
             # Blockquote:

lib/gitlab/hook_data/base_builder.rb

+module Gitlab
+  module HookData
+    class BaseBuilder
+      attr_accessor :object
+
+      MARKDOWN_SIMPLE_IMAGE = %r{
+          #{::Gitlab::Regex.markdown_code_or_html_blocks}
+        |
+          (?<image>
+            !
+            \[(?<title>[^\n]*?)\]
+            \((?<url>(?!(https?://|//))[^\n]+?)\)
+          )
+      }mx.freeze
+
+      def initialize(object)
+        @object = object
+      end
+
+      private
+
+      def absolute_image_urls(markdown_text)
+        return markdown_text unless markdown_text.present?
+
+        markdown_text.gsub(MARKDOWN_SIMPLE_IMAGE) do
+          if $~[:image]
+            url = $~[:url]
+            url = "/#{url}" unless url.start_with?('/')
+
+            "![#{$~[:title]}](#{Gitlab.config.gitlab.url}#{url})"
+          else
+            $~[0]
+          end
+        end
+      end
+    end
+  end
+end

lib/gitlab/hook_data/issuable_builder.rb

 module Gitlab
   module HookData
-    class IssuableBuilder
+    class IssuableBuilder < BaseBuilder
       CHANGES_KEYS = %i[previous current].freeze
 
-      attr_accessor :issuable
-
-      def initialize(issuable)
-        @issuable = issuable
-      end
+      alias_method :issuable, :object
 
       def build(user: nil, changes: {})
         hook_data = {

lib/gitlab/hook_data/issue_builder.rb

 module Gitlab
   module HookData
-    class IssueBuilder
+    class IssueBuilder < BaseBuilder
       SAFE_HOOK_ATTRIBUTES = %i[
         assignee_id
         author_id
@@ -30,14 +30,11 @@ module Gitlab
         total_time_spent
       ].freeze
 
-      attr_accessor :issue
-
-      def initialize(issue)
-        @issue = issue
-      end
+      alias_method :issue, :object
 
       def build
         attrs = {
+          description: absolute_image_urls(issue.description),
           url: Gitlab::UrlBuilder.build(issue),
           total_time_spent: issue.total_time_spent,
           human_total_time_spent: issue.human_total_time_spent,

lib/gitlab/hook_data/merge_request_builder.rb

 module Gitlab
   module HookData
-    class MergeRequestBuilder
+    class MergeRequestBuilder < BaseBuilder
       SAFE_HOOK_ATTRIBUTES = %i[
         assignee_id
         author_id
@@ -35,14 +35,11 @@ module Gitlab
         total_time_spent
       ].freeze
 
-      attr_accessor :merge_request
-
-      def initialize(merge_request)
-        @merge_request = merge_request
-      end
+      alias_method :merge_request, :object
 
       def build
         attrs = {
+          description: absolute_image_urls(merge_request.description),
           url: Gitlab::UrlBuilder.build(merge_request),
           source: merge_request.source_project.try(:hook_attrs),
           target: merge_request.target_project.hook_attrs,

lib/gitlab/hook_data/note_builder.rb

+module Gitlab
+  module HookData
+    class NoteBuilder < BaseBuilder
+      SAFE_HOOK_ATTRIBUTES = %i[
+        attachment
+        author_id
+        change_position
+        commit_id
+        created_at
+        discussion_id
+        id
+        line_code
+        note
+        noteable_id
+        noteable_type
+        original_position
+        position
+        project_id
+        resolved_at
+        resolved_by_id
+        resolved_by_push
+        st_diff
+        system
+        type
+        updated_at
+        updated_by_id
+      ].freeze
+
+      alias_method :note, :object
+
+      def build
+        note
+          .attributes
+          .with_indifferent_access
+          .slice(*SAFE_HOOK_ATTRIBUTES)
+          .merge(
+            description: absolute_image_urls(note.note),
+            url: Gitlab::UrlBuilder.build(note)
+          )
+      end
+    end
+  end
+end

lib/gitlab/hook_data/wiki_page_builder.rb

+module Gitlab
+  module HookData
+    class WikiPageBuilder < BaseBuilder
+      alias_method :wiki_page, :object
+
+      def build
+        wiki_page
+          .attributes
+          .merge(
+            'content' => absolute_image_urls(wiki_page.content)
+          )
+      end
+    end
+  end
+end

lib/gitlab/import_export/file_importer.rb

@@ -4,6 +4,7 @@ module Gitlab
       include Gitlab::ImportExport::CommandLineUtil
 
       MAX_RETRIES = 8
+      IGNORED_FILENAMES = %w(. ..).freeze
 
       def self.import(*args)
         new(*args).import
@@ -59,7 +60,7 @@ module Gitlab
       end
 
       def extracted_files
-        Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| f =~ %r{.*/\.{1,2}$} }
+        Dir.glob("#{@shared.export_path}/**/*", File::FNM_DOTMATCH).reject { |f| IGNORED_FILENAMES.include?(File.basename(f)) }
       end
     end
   end

lib/gitlab/regex.rb

@@ -74,5 +74,31 @@ module Gitlab
     def build_trace_section_regex
       @build_trace_section_regexp ||= /section_((?:start)|(?:end)):(\d+):([a-zA-Z0-9_.-]+)\r\033\[0K/.freeze
     end
+
+    def markdown_code_or_html_blocks
+      @markdown_code_or_html_blocks ||= %r{
+          (?<code>
+            # Code blocks:
+            # ```
+            # Anything, including `>>>` blocks which are ignored by this filter
+            # ```
+
+            ^```
+            .+?
+            \n```\ *$
+          )
+        |
+          (?<html>
+            # HTML block:
+            # <tag>
+            # Anything, including `>>>` blocks which are ignored by this filter
+            # </tag>
+
+            ^<[^>]+?>\ *\n
+            .+?
+            \n<\/[^>]+?>\ *$
+          )
+      }mx
+    end
   end
 end

locale/gitlab.pot

@@ -8,8 +8,13 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gitlab 1.0.0\n"
 "Report-Msgid-Bugs-To: \n"
+<<<<<<< HEAD
 "POT-Creation-Date: 2018-07-17 07:12+0000\n"
 "PO-Revision-Date: 2018-07-17 07:12+0000\n"
+=======
+"POT-Creation-Date: 2018-07-10 16:02-0700\n"
+"PO-Revision-Date: 2018-07-10 16:02-0700\n"
+>>>>>>> upstream/master
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
 "Language: \n"
@@ -162,9 +167,6 @@ msgstr[1] ""
 msgid "%{unstaged} unstaged and %{staged} staged changes"
 msgstr ""
 
-msgid "(check out the %{link} for information on how to install it)."
-msgstr ""
-
 msgid "+ %{moreCount} more"
 msgstr ""
 
@@ -2062,6 +2064,9 @@ msgstr ""
 msgid "Copy to clipboard"
 msgstr ""
 
+msgid "Copy token to clipboard"
+msgstr ""
+
 msgid "Create"
 msgstr ""
 
@@ -3188,9 +3193,6 @@ msgstr ""
 msgid "GitLab Import"
 msgstr ""
 
-msgid "GitLab Runner section"
-msgstr ""
-
 msgid "GitLab User"
 msgstr ""
 
@@ -3580,10 +3582,10 @@ msgstr ""
 msgid "Inline"
 msgstr ""
 
-msgid "Install Runner on Kubernetes"
+msgid "Install GitLab Runner"
 msgstr ""
 
-msgid "Install a Runner compatible with GitLab CI"
+msgid "Install Runner on Kubernetes"
 msgstr ""
 
 msgid "Instance"

spec/javascripts/diffs/components/diff_file_header_spec.js

@@ -24,7 +24,7 @@ describe('diff_file_header', () => {
     const diffFile = convertObjectPropsToCamelCase(diffDiscussionMock.diff_file, { deep: true });
     props = {
       diffFile,
-      currentUser: {},
+      canCurrentUserFork: false,
     };
   });
 

spec/javascripts/diffs/components/diff_file_spec.js

@@ -11,7 +11,7 @@ describe('DiffFile', () => {
   beforeEach(() => {
     vm = createComponentWithStore(Vue.extend(DiffFileComponent), store, {
       file: getDiffFileMock(),
-      currentUser: {},
+      canCurrentUserFork: false,
     }).$mount();
   });
 

spec/javascripts/diffs/components/diff_line_note_form_spec.js

@@ -15,7 +15,7 @@ describe('DiffLineNoteForm', () => {
     diffLines = diffFile.highlightedDiffLines;
 
     component = createComponentWithStore(Vue.extend(DiffLineNoteForm), store, {
-      diffFile,
+      diffFileHash: diffFile.fileHash,
       diffLines,
       line: diffLines[0],
       noteTargetLine: diffLines[0],

spec/javascripts/diffs/store/getters_spec.js

@@ -184,4 +184,23 @@ describe('Diffs Module Getters', () => {
       ).toEqual(0);
     });
   });
+
+  describe('getDiffFileByHash', () => {
+    it('returns file by hash', () => {
+      const fileA = {
+        fileHash: '123',
+      };
+      const fileB = {
+        fileHash: '456',
+      };
+      localState.diffFiles = [fileA, fileB];
+
+      expect(getters.getDiffFileByHash(localState)('456')).toEqual(fileB);
+    });
+
+    it('returns null if no matching file is found', () => {
+      localState.diffFiles = [];
+      expect(getters.getDiffFileByHash(localState)('123')).toBeUndefined();
+    });
+  });
 });

spec/javascripts/monitoring/mock_data.js

@@ -6561,6 +6561,9 @@ export const environmentData = [
       folder_path: '/root/hello-prometheus/environments/folders/production',
       created_at: '2018-06-29T16:53:38.301Z',
       updated_at: '2018-06-29T16:57:09.825Z',
+      last_deployment: {
+        id: 127,
+      },
     },
   },
   {
@@ -6580,6 +6583,20 @@ export const environmentData = [
       folder_path: '/root/hello-prometheus/environments/folders/review',
       created_at: '2018-07-03T18:39:41.702Z',
       updated_at: '2018-07-03T18:44:54.010Z',
+      last_deployment: {
+        id: 128,
+      },
+    },
+  },
+  {
+    name: 'no-deployment',
+    size: 1,
+    latest: {
+      id: 36,
+      name: 'no-deployment/noop-branch',
+      state: 'available',
+      created_at: '2018-07-04T18:39:41.702Z',
+      updated_at: '2018-07-04T18:44:54.010Z',
     },
   },
 ];

spec/javascripts/monitoring/monitoring_store_spec.js

 import MonitoringStore from '~/monitoring/stores/monitoring_store';
-import MonitoringMock, { deploymentData } from './mock_data';
+import MonitoringMock, { deploymentData, environmentData } from './mock_data';
 
 describe('MonitoringStore', function () {
   this.store = new MonitoringStore();
@@ -21,4 +21,9 @@ describe('MonitoringStore', function () {
     expect(this.store.deploymentData.length).toEqual(3);
     expect(typeof this.store.deploymentData[0]).toEqual('object');
   });
+
+  it('only stores environment data that contains deployments', () => {
+    this.store.storeEnvironmentsData(environmentData);
+    expect(this.store.environmentsData.length).toEqual(2);
+  });
 });

spec/lib/gitlab/hook_data/base_builder_spec.rb

+require 'spec_helper'
+
+describe Gitlab::HookData::BaseBuilder do
+  describe '#absolute_image_urls' do
+    let(:subclass) do
+      Class.new(described_class) do
+        public :absolute_image_urls
+      end
+    end
+
+    subject { subclass.new(nil) }
+
+    using RSpec::Parameterized::TableSyntax
+
+    where do
+      {
+        'relative image URL' => {
+          input: '![an image](foo.png)',
+          output: "![an image](#{Gitlab.config.gitlab.url}/foo.png)"
+        },
+        'HTTP URL' => {
+          input: '![an image](http://example.com/foo.png)',
+          output: '![an image](http://example.com/foo.png)'
+        },
+        'HTTPS URL' => {
+          input: '![an image](https://example.com/foo.png)',
+          output: '![an image](https://example.com/foo.png)'
+        },
+        'protocol-relative URL' => {
+          input: '![an image](//example.com/foo.png)',
+          output: '![an image](//example.com/foo.png)'
+        },
+        'URL reference by title' => {
+          input: "![foo]\n\n[foo]: foo.png",
+          output: "![foo]\n\n[foo]: foo.png"
+        },
+        'URL reference by label' => {
+          input: "![][foo]\n\n[foo]: foo.png",
+          output: "![][foo]\n\n[foo]: foo.png"
+        },
+        'in Markdown inline code block' => {
+          input: '`![an image](foo.png)`',
+          output: "`![an image](#{Gitlab.config.gitlab.url}/foo.png)`"
+        },
+        'in HTML tag on the same line' => {
+          input: '<p>![an image](foo.png)</p>',
+          output: "<p>![an image](#{Gitlab.config.gitlab.url}/foo.png)</p>"
+        },
+        'in Markdown multi-line code block' => {
+          input: "```\n![an image](foo.png)\n```",
+          output: "```\n![an image](foo.png)\n```"
+        },
+        'in HTML tag on different lines' => {
+          input: "<p>\n![an image](foo.png)\n</p>",
+          output: "<p>\n![an image](foo.png)\n</p>"
+        }
+      }
+    end
+
+    with_them do
+      it { expect(subject.absolute_image_urls(input)).to eq(output) }
+    end
+  end
+end

spec/lib/gitlab/hook_data/issue_builder_spec.rb

@@ -40,5 +40,14 @@ describe Gitlab::HookData::IssueBuilder do
       expect(data).to include(:human_total_time_spent)
       expect(data).to include(:assignee_ids)
     end
+
+    context 'when the issue has an image in the description' do
+      let(:issue_with_description) { create(:issue, description: 'test![Issue_Image](/uploads/abc/Issue_Image.png)') }
+      let(:builder) { described_class.new(issue_with_description) }
+
+      it 'sets the image to use an absolute URL' do
+        expect(data[:description]).to eq("test![Issue_Image](#{Settings.gitlab.url}/uploads/abc/Issue_Image.png)")
+      end
+    end
   end
 end

spec/lib/gitlab/hook_data/merge_request_builder_spec.rb

@@ -56,5 +56,14 @@ describe Gitlab::HookData::MergeRequestBuilder do
       expect(data).to include(:human_time_estimate)
       expect(data).to include(:human_total_time_spent)
     end
+
+    context 'when the MR has an image in the description' do
+      let(:mr_with_description) { create(:merge_request, description: 'test![Issue_Image](/uploads/abc/Issue_Image.png)') }
+      let(:builder) { described_class.new(mr_with_description) }
+
+      it 'sets the image to use an absolute URL' do
+        expect(data[:description]).to eq("test![Issue_Image](#{Settings.gitlab.url}/uploads/abc/Issue_Image.png)")
+      end
+    end
   end
 end

spec/lib/gitlab/import_export/file_importer_spec.rb

@@ -7,6 +7,7 @@ describe Gitlab::ImportExport::FileImporter do
   let(:symlink_file) { "#{shared.export_path}/invalid.json" }
   let(:hidden_symlink_file) { "#{shared.export_path}/.hidden" }
   let(:subfolder_symlink_file) { "#{shared.export_path}/subfolder/invalid.json" }
+  let(:evil_symlink_file) { "#{shared.export_path}/.\nevil" }
 
   before do
     stub_const('Gitlab::ImportExport::FileImporter::MAX_RETRIES', 0)
@@ -34,6 +35,10 @@ describe Gitlab::ImportExport::FileImporter do
       expect(File.exist?(hidden_symlink_file)).to be false
     end
 
+    it 'removes evil symlinks in root folder' do
+      expect(File.exist?(evil_symlink_file)).to be false
+    end
+
     it 'removes symlinks in subfolders' do
       expect(File.exist?(subfolder_symlink_file)).to be false
     end
@@ -75,5 +80,7 @@ describe Gitlab::ImportExport::FileImporter do
     FileUtils.touch(valid_file)
     FileUtils.ln_s(valid_file, symlink_file)
     FileUtils.ln_s(valid_file, subfolder_symlink_file)
+    FileUtils.ln_s(valid_file, hidden_symlink_file)
+    FileUtils.ln_s(valid_file, evil_symlink_file)
   end
 end

spec/models/wiki_page_spec.rb

@@ -554,6 +554,16 @@ describe WikiPage do
     end
   end
 
+  describe '#hook_attrs' do
+    it 'adds absolute urls for images in the content' do
+      create_page("test page", "test![WikiPage_Image](/uploads/abc/WikiPage_Image.png)")
+      page = wiki.wiki.page(title: "test page")
+      wiki_page = described_class.new(wiki, page, true)
+
+      expect(wiki_page.hook_attrs['content']).to eq("test![WikiPage_Image](#{Settings.gitlab.url}/uploads/abc/WikiPage_Image.png)")
+    end
+  end
+
   private
 
   def remove_temp_repo(path)