[ci skip]

[ci skip]

[ci skip]

[ci skip]

#40 - Denial of service via AsciiDoc include:: overuse

See merge request gitlab-org/security/gitlab!133

This sets a maximum limit on the number of include directives that any
one file may use (transitively). This is set relatively low at the
moment to 32 since each one requires a gitlay call to retrieve a blob
from the repo, and experimentation suggests that this keeps processing
to under 10sec.

This approach prevents both cyclic imports as well as having a single
file with an extremely lang list of includes.

Show last_pipeline in commits API only if user can read pipeline

Closes #5

See merge request gitlab-org/security/gitlab!13

Bump rubyzip to 2.0.0

Closes #13

See merge request gitlab-org/security/gitlab!41

Disable caching on API project/raw endpoint

See merge request gitlab-org/security/gitlab!49

Fix xss on frequent groups dropdown

Closes #15

See merge request gitlab-org/security/gitlab!50

Enforce permission check when counting events

See merge request gitlab-org/security/gitlab!51

Prevent API access for unconfirmed users

See merge request gitlab-org/security/gitlab!52

Mask grafana token with encryption

See merge request gitlab-org/security/gitlab!53

Remove todos for users from removed linked group

See merge request gitlab-org/security/gitlab!59

Fix reference visibility check

Closes #23

See merge request gitlab-org/security/gitlab!66

ImportExport::ExportService to require admin_project permission

See merge request gitlab-org/security/gitlab!69

Protect internal builds from external overrides

Closes #22

See merge request gitlab-org/security/gitlab!72

Add constraint to dependency proxy route

See merge request gitlab-org/security/gitlab!77

Verify workhorse request for file uploads

See merge request gitlab-org/security/gitlab!83

Make cross-repository comparisons happen in the source repository

Closes #29

See merge request gitlab-org/security/gitlab!84

Update excon to 0.71.1 to fix CVE-2019-16779

Closes #35

See merge request gitlab-org/security/gitlab!102

Fix XSS vulnerability on custom project templates form

Closes #32

See merge request gitlab-org/security/gitlab!111

Clarify the usage of `trigger:strategy`

See merge request gitlab-org/gitlab!23583

Revert "Merge branch 'georgekoltsov/group_seeder_rake_task' into 'master'"

See merge request gitlab-org/gitlab!23852

Add `gitlab_page_out_of_bounds` to Prometheus docs

Closes #198475

See merge request gitlab-org/gitlab!23802

Refactor instance security dashboard permissions

See merge request gitlab-org/gitlab!22740

This commit updates the instance security dashboard controllers to get
their permission scheme from the same concern as the group and project
security dashboard controllers.

Refactoring: Move "Credential inventory" to a re-usable concern

Closes #38133

See merge request gitlab-org/gitlab!23495

Frontend: Rename Sast Container to Container Scanning

See merge request gitlab-org/gitlab!23814

We haven't been using the Sast Container term in a long time and this
renames all the occurences in the Merge Request widget VueX store

Resolve "NoMethodError: undefined method `unsubscribe' for nil:NilClass"

Closes #199034

See merge request gitlab-org/gitlab!23747

This reverts merge request !21657

Clarify usage of Merge Request, merge request, and MR

See merge request gitlab-org/gitlab!23646

This change moves the methods used for Credentials Inventory
feature to a re-usable concern.

Add http status cop in project controller specs

See merge request gitlab-org/gitlab!23801

Docs: update docs style guide for headings and anchors

See merge request gitlab-org/gitlab!23777

Create SSOT for package manager formats

See merge request gitlab-org/gitlab!23805