Update language after doing all other operations

See merge request !3533
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix 2FA authentication spoofing

## Summary

This is security fix for vulnerability described at
https://gitlab.com/gitlab-org/gitlab-ce/issues/14900.

Attacker was able to bypass password authentication of users that have 2FA enabled, and consequently sign is as a different user, without knowing his password, if he managed to guess 2FA One Time Password for that user.

It was also possible to enumerate users and check if they have 2FA enabled, because GitLab responded with different error for each case.

## Fix

This MR attempts to change default user search scope if `otp_user_id` session variable has been set. If it is present, it means that user has 2FA enabled, and has already been verified with login and password. In this case we should look for user with `otp_user_id` first, before picking it up by `login`.

Both, 2FA authentication spoofing and 2FA discovery have been covered by specs.

## Further work

Current 2FA code is a bit tricky, so it probably needs some refactoring.

See merge request !1947
Signed-off-by: Rémy Coutable <remy@rymai.me>

Return status code 303 after a branch DELETE operation to avoid project deletion

Closes #14994

See merge request !3583
Signed-off-by: Rémy Coutable <remy@rymai.me>

Only update main language if it is not already set

Related to gitlab-org/gitlab-ce#14937 (but does not fully fix) This is a temporary fix so performance isn't affected so much.

cc @yorickpeterse @ayufan how does this look?

See merge request !3556
Signed-off-by: Rémy Coutable <remy@rymai.me>

Check permissions when importing project members

Closes #14899

See merge request !3535
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix Importing repos from GHE doesn't work

See merge request !3529
Signed-off-by: Rémy Coutable <remy@rymai.me>

Don't fetch any tags from a forked repo

Closes #13957

See merge request !3504
Signed-off-by: Rémy Coutable <remy@rymai.me>

[ci skip]
Signed-off-by: Rémy Coutable <remy@rymai.me>

Update gitlab-shell version and doc to 2.6.12



See merge request !280

[ci skip]
Signed-off-by: Rémy Coutable <remy@rymai.me>

Allow temp-oauth-email as notification email

Closes #14559

/cc @dblessing @rymai

See merge request !3477
Signed-off-by: Rémy Coutable <remy@rymai.me>

Ensuring Merge Request API returns boolean values for work_in_progress

Fixes #14692.

See merge request !3432
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fixes issue with dropdowns not selecting values

Fixes issue with dropdowns not selecting when navigating between tabs

Closes #14813

See merge request !3478
Signed-off-by: Rémy Coutable <remy@rymai.me>

Merge branch 'snippets-with-comments-cause-a-500-when-they-show-up-in-search-results-14764' into 'master'

Fix Error 500 when searching for a comment in a project snippet

Closes #14764. /cc @stanhu, and thank you for the spec! ;)

See merge request !3468
Signed-off-by: Rémy Coutable <remy@rymai.me>

Mentions on confidential issues doesn't create todos for non-members

Closes #14569

See merge request !3374
Signed-off-by: Rémy Coutable <remy@rymai.me>

Rewrite uploads when moving issue to another project

Closes #14531

See merge request !3382
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix commit comment alignment

Closes #14780

See merge request !3466
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix Raw / Rendered diff producing different results on merge requests

The raw diff endpoint (`merge_requests/####.diff`) produces a diff based on `target_branch` instead of the original branching point. Same is valid for `merge_requests/####.patch`.

Fixes #14680, #3017

See merge request !3450
Signed-off-by: Rémy Coutable <remy@rymai.me>

Destroy related todos when an Issue/MR is deleted

Closes #14550 

Closes #14598

See merge request !3376

Signed-off-by: Rémy Coutable <remy@rymai.me>

Fixed issue with notification settings not saving

Closes #14736

See merge request !3452
Signed-off-by: Rémy Coutable <remy@rymai.me>

Gracefully handle notes on deleted commits in merge requests

Closes #3250

See merge request !3402
Signed-off-by: Rémy Coutable <remy@rymai.me>

Remove redundant `require`s from Banzai files

We're trying to avoid circular dependency errors.

Related: https://gitlab.com/gitlab-org/gitlab-ce/issues/13521

Sentry: https://sentry.gitlap.com/gitlab/gitlabcom/issues/8/

See merge request !3391
Signed-off-by: Rémy Coutable <remy@rymai.me>

Dropdown bug fixes

- Added back upcoming to milestone filter

![Screen_Shot_2016-03-23_at_16.45.22](/uploads/8c31eff7e0984aad17881f6397ff17cd/Screen_Shot_2016-03-23_at_16.45.22.png)

- Fixed bug that would cause the currently selected value to disappear on filters
- Fixed bug that throw an error when filtering by upcoming when there is only a milestone in the past

Closes #14536

See merge request !3368
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix cancel button on issuables

Fixes #14671

See merge request !3417
Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix order of steps to prevent PostgreSQL errors when running migration

Supersedes https://github.com/gitlabhq/gitlabhq/pull/10100.

/cc @stanhu @rodrigomanhaes

See merge request !3355

Fix error when visiting CI root path

Closes #14528, closes #14687

See merge request !3377

Ensure private project snippets are not viewable by unauthorized people

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/14607

See merge request !1946

Remove tabstop from the WIP toggle links

[ci skip]

See merge request !3426

Fix background when editing a highlighted note

Fixes #14643

See merge request !3423

Fix cancel button on issuable edit form

See merge request !3392

Fixed issue with width of project select dropdown

Before:

![Screen_Shot_2016-03-24_at_13.42.53](/uploads/25580c45dc339f7f932f032ac2d10fba/Screen_Shot_2016-03-24_at_13.42.53.png)

![Screen_Shot_2016-03-24_at_13.43.04](/uploads/e4d1d4e332d27f14c980264bef9dc4d9/Screen_Shot_2016-03-24_at_13.43.04.png)

After:

![Screen_Shot_2016-03-24_at_13.42.38](/uploads/68b8e161d86b41849f9e8a1d9c8fd36c/Screen_Shot_2016-03-24_at_13.42.38.png)

![Screen_Shot_2016-03-24_at_13.43.13](/uploads/f3fe732bcd517efea3a1d7c761bb6a0e/Screen_Shot_2016-03-24_at_13.43.13.png)

See merge request !3386

Add links to CI setup documentation from project settings and builds pages

For #14483
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

See merge request !3384

Shows password form when signed in with linked account

Closes #14379

Doing this to get the builds passing for !3325

See merge request !3381

Merge branch 'add-tooltip-to-issue-new-branch-button-with-create-branch-issue-title-123-14565' into 'master'

Add tooltip to new branch button

Closes #14565

See merge request !3380

Comments on confidential issues doesn't show in activity feed to non-members

Closes #14568

See merge request !3375