Fix missing access checks on issue lookup using IssuableFinder

Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867

⚠ - Potentially untested
💣 - No test coverage
🚥 - Test coverage of some sort exists (a test failed when error raised)
🚦 - Test coverage of return value (a test failed when nil used)
✅ - Permissions check tested

- [x] ✅ app/controllers/projects/branches_controller.rb:39
  - `before_action :authorize_push_code!` helpes limit/prevent exploitation. Always checks for reporter access so fine with
    confidential issues, issues only visible to team, etc.
- [x] 🚥 app/models/cycle_analytics/summary.rb:9 [`.count`]
- [x] ✅ app/controllers/projects/todos_controller.rb:19

- [x] Potential double render in app/controllers/projects/todos_controller.rb

- https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#cedccb227af9bfdf88802767cb58d43c2b977439_24_24

See merge request !2030

Replace issue access checks with use of IssuableFinder

Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867

## Which fixes are in this MR?

⚠ - Potentially untested  
💣 - No test coverage  
🚥 - Test coverage of some sort exists (a test failed when error raised)  
🚦 - Test coverage of return value (a test failed when nil used)  
✅ - Permissions check tested

### Issue lookup with access check

Using `visible_to_user` likely makes these security issues too. See [Code smells](#code-smells).

- [x] 🚦 app/finders/notes_finder.rb:15 [`visible_to_user`]
- [x] 🚥 app/views/layouts/nav/_project.html.haml:73 [`visible_to_user`] [`.count`]
- [x] ✅ app/services/merge_requests/build_service.rb:84 [`issue.try(:confidential?)`]
- [x] ✅ lib/api/issues.rb:112 [`visible_to_user`]
  - CHANGELOG: Prevented API returning issues set to 'Only team members' to everyone
- [x] ✅ lib/api/helpers.rb:126 [`can?(current_user, :read_issue, issue)`] Maybe here too?
- [x] ✅ lib/gitlab/search_results.rb:53 [`visible_to_user`]

### Previous discussions
- [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b2ff264eddf9819d7693c14ae213d941494fe2b3_128_126
- [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#7b6375270d22f880bdcb085e47b519b426a5c6c7_87_87

See merge request !2031

Fix information disclosure in `Projects::BlobController#update`

It was possible to discover private project names by modifying `from_merge_request`parameter in `Projects::BlobController#update`. This fixes that.

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.md) entry added
- Tests
  - [x] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

https://gitlab.com/gitlab-org/gitlab-ce/issues/22869

See merge request !2023

Fix label creation non members

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/23416

See merge request !2006

Fix deselecting calendar days on contribution graph

## What does this MR do?
Fix deselecting calendar days on contribution graph

## Are there points in the code the reviewer needs to double check?
Shouldn't be

## Why was this MR needed?
In `master`, you can currently deselect a calendar day after selecting but you cannot reselect that day.

## Screenshots (if relevant)
Before:
![2016-10-25_10.42.20](/uploads/7d442c09cd15082cf69f673a544b56f9/2016-10-25_10.42.20.gif)

After:
![2016-10-25_10.40.35](/uploads/6123365f0ec63ee84658ee6057e7715c/2016-10-25_10.40.35.gif)

## Does this MR meet the acceptance criteria?

- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- Tests
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?
Closes #22381

See merge request !6453

Unify all MR widget text colors and background colors

* Removes darker background color for `skipped` status
* Makes all MR widget text gray
Before:   
![Screen_Shot_2016-11-18_at_7.52.16_AM](/uploads/4ee715aec9c453c5cfe1f259049adbde/Screen_Shot_2016-11-18_at_7.52.16_AM.png)
After:   
![Screen_Shot_2016-11-18_at_7.52.05_AM](/uploads/ea14d713a4e7d837bac4576815451dce/Screen_Shot_2016-11-18_at_7.52.05_AM.png)

Closes #24639

See merge request !7571

If Build running change accept merge request when build succeeds button from orange to blue

## What does this MR do?

If Build running change accept merge request when build succeeds button from orange to blue

## Are there points in the code the reviewer needs to double check?

I didn't really check, but to my knowledge these changes should fix it. Would love to know how to set up working pipelines in my local build.

## Why was this MR needed?

orange was to big a warning color for this button


## Screenshots (if relevant)

![image](https://gitlab.com/gitlab-org/gitlab-ce/uploads/c9100be272c5567ee4dfa281cffaeb7a/_24266_merge-request-01.png)
![image](https://gitlab.com/gitlab-org/gitlab-ce/uploads/bb84ea5b519fc67babf8383f3b396fb7/_24266_merge-request-02.png)

## Does this MR meet the acceptance criteria?

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [ ] All builds are passing
- [ ] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [ ] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [ ] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?


Closes #24266

See merge request !7577

move timeago.js to vendor directory

## What does this MR do?

moves timeago.js into `/vendor/assets/javascripts` for consistency with other external javascript libraries.

## Are there points in the code the reviewer needs to double check?

make sure timeago still works as it should...?  I don't see how this could have broken anything.

## Why was this MR needed?

consistency with our guidelines

## Does this MR meet the acceptance criteria?

- Tests
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

See discussion in [!6274](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/6274#note_18625583)

See merge request !7590

Merge branch '24161-non-intuitive-buttons-for-import-sources-in-administrator-settings-enable-disable' into 'master'

Import sources buttons to checkboxes

## What does this MR do?

Swaps the `/application_settings` `Import Sources` buttons to checkboxes.

## Are there points in the code the reviewer needs to double check?

## Why was this MR needed?

## Screenshots (if relevant)

![2016-11-19_14.42.39](/uploads/5bf53ecb54765bd80ab275714208ee9a/2016-11-19_14.42.39.gif)

## Does this MR meet the acceptance criteria?

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?


Closes #24161

See merge request !7598

External jobs do not have show page nor traces

Fixes #24677

See merge request !7617

Issue creation now accepts trailing whitespace

See merge request !7633

Resolve "Labeling system notes downcase labels"

## What does this MR do?
This MR fixes issues of label gets lowercase in system note as describe in #24737

## Are there points in the code the reviewer needs to double check?
NR
## Why was this MR needed?
This MR fixes the regression of becoming labels and its description and title lowercase in system note
  
## Screenshots (if relevant)
**Before:**
![before](/uploads/ac99fd5d1219ee3b4b7c699319267087/before.png)

**After:** 
![after](/uploads/d1b6413c857d18f122252f421ac498b0/after.png)

## Does this MR meet the acceptance criteria?

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?


Closes #24737 
Closes #24751

See merge request !7636

Fix NPM install warnings due to incompatible dependency version

## What does this MR do?

Rolls back `eslint-plugin-import` to semver `^1.16.0` for compatibility with `eslint-config-airbnb`.

## Are there points in the code the reviewer needs to double check?

Shouldn't be.

## Why was this MR needed?

A warning message was being generated every time we run `npm install`, and there are possibly other side effects due to module incompatibility.

## Does this MR meet the acceptance criteria?

- [x] All builds are passing
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)

## What are the relevant issue numbers?

Closes #24754

See merge request !7641

Clean up globals exemptions within .eslintrc

## What does this MR do?

Removes unnecessarily-exempted globals from `.eslintrc` where possible.

## Are there points in the code the reviewer needs to double check?

`npm run eslint` should return 0 errors.

## Why was this MR needed?

see Issue #24756 

## Does this MR meet the acceptance criteria?

- Tests
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

Closes #24756

See merge request !7642

Last minute CI Style tweaks for 8.14

## What does this MR do?
- Skipped builds now have use a lighter gray.
- Converted all status icons to be managed by scss colors only
- Consolidated all status icon styles into icons.scss
- Deleted any classes or styles within the svg's
- Gave status badges a hover style, but only if clickable
- Fixed alignment issue mini-pipeline graph

## Are there points in the code the reviewer needs to double check?

## Why was this MR needed?
As per the discussion in the slack chat https://gitlab.slack.com/archives/ci/p1479743986004879

## Screenshots (if relevant)
- skipped builds:
![image](/uploads/f59c615045472b9b13940463a64c8038/image.png)
![image](/uploads/26503d1da9c93b3c22c5c0c1369feceb/image.png)

- hover style status badges:
![2016-11-22_00.21.27](/uploads/36afa7aa64d60e1755bf39d97f90c59f/2016-11-22_00.21.27.gif)![2016-11-22_00.58.38](/uploads/1d95fa5db124412d3f83b3e79b9b71ec/2016-11-22_00.58.38.gif)

- mini pipeline graph:

before:
![image](/uploads/38e5e57ada3907b17c6e24e1446b4514/image.png)


after:
![image](/uploads/de4476693a1397eebfc680661159daf7/image.png)


## Does this MR meet the acceptance criteria?

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [ ] All builds are passing
- [ ] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [ ] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [ ] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

See merge request !7643

Fix IID filter for merge requests and milestones

I updated the example in the docs and added a test. The milestones API was also broken for the same reason.

Related to !7358 and !7373

See merge request !7648

Fix Sidekiq stats in admin area

Closes #23825, #24675 

See merge request !7654

Fix exceptions when loading build trace

## What does this MR do?

This MR fixes exceptions when loading build trace.

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- [x] Tests added for this feature/bug

## What are the relevant issue numbers?

Closes #24638

See merge request !7658

fixed bug to do with calculating durations

Fixes a couple of small bugs while calculating durations in cycle analytics - probably due to some bad refactoring

- [ ] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- Tests
  - [x] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/24796

See merge request !7663

Merge branch '24804-wrong-render-index-should-be-render-show-in-projects-pipelinessettingscontroller-update' into 'master'

Resolve "Wrong `render 'index'`, should be `render 'show'` in `Projects::PipelinesSettingsController#update`"

Closes #24804

See merge request !7665

changes environment.last_deployment to a try expression so it does not fail if e…

## What does this MR do?

Fixes the call on `environment.last_deployment` to not break when `environment`is not yet set.

## Does this MR meet the acceptance criteria?

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- [x] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [x] API support added
- Tests
  - [x] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?


Closes #24779

See merge request !7671

Add changes to JIRA api docs

See merge request !7675

Fix spacing between icon and word in status badge

Before:      
![Screen_Shot_2016-11-22_at_11.44.16_AM](/uploads/65c5abc6dc08985cb3079b7c2af03715/Screen_Shot_2016-11-22_at_11.44.16_AM.png)
After:   
![Screen_Shot_2016-11-22_at_11.44.01_AM](/uploads/1b6261b64c65de5a718b68873e069ac9/Screen_Shot_2016-11-22_at_11.44.01_AM.png)

cc @dimitrieh

See merge request !7678

Sort pipeline graph builds and build groups by name

## What does this MR do?

Sorts builds and build groups by name within pipeline graphs

## Are there points in the code the reviewer needs to double check?

Shouldn't be. This was a one-line change.

## Why was this MR needed?

It can be difficult to find the build you are looking for within a group of similarly-named builds when they are in a seemingly random order.

## Screenshots (if relevant)

### Before:

![Screen_Shot_2016-11-22_at_2.48.11_PM](/uploads/27f3f9a2e29e7f0e5857bfd425b74306/Screen_Shot_2016-11-22_at_2.48.11_PM.png)

### After:

![Screen_Shot_2016-11-22_at_2.47.46_PM](/uploads/2c6ef1446a1de0012d091d6deef0992b/Screen_Shot_2016-11-22_at_2.47.46_PM.png)

## Does this MR meet the acceptance criteria?

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- Tests
  - [ ] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

Closes #24739

See merge request !7681

Fix cycle analytics plan stage when commits are missing

Takes into account when commits are `nil` so the app doesn't throw an exception and also removes them.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/24836

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- Tests
  - [x] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)


See merge request !7694

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/24863

See merge request !7698

Fixed dragging issues on issue boards

## What does this MR do?

This fixes a few issues all at once:

- Fixes an issue when dragging an issue to a list but actually removes another issue from the original list
- Fixes an issue that caused the issue card to be appended to the bottom of the list
- Fixes an issue when dragging an issue would actually open up the sidebar

## What are the relevant issue numbers?

Closes #24654

See merge request !7701

Fix `LFS enabled` select box.

A refactor of the project edit page caused the `lfs_enabled` setting to be reverted to a non functioning state. This MR fixes that.

This will most likely need to be ported back to 8.13 and 8.14. 8.12 contained the correct code.

Fixes #24645 

Related commits:

- ea3bbbde
- da07c2e4

cc @stanhu @dblessing @dbalexandre @rymai

See merge request !7716

[ci skip]

See merge request !7676

See merge request !7672

Do not use MergeRequest#commits in define_pipelines_vars

## What does this MR do?

`MergeRequest#commits` requires merge_request_diff to be present.
This is not the case when creating a new merge request.

## What are the relevant issue numbers?

Fix up for https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7568

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/24798

See merge request !7664

Preserve optional second parameter in NewNoteWorker jobs
    
Closes #24678

See merge request !7602

Handle orphans when removing soft deleted groups

This fixes the migration from https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7528 so it handles orphans as mentioned in https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7528/diffs#note_18800962.

This needs to go in 8.14.0 as otherwise customers may run into the same problem.

See merge request !7657

Add new image for Cycle Analytics

See merge request !7666

Docs on Mattermost commands

Still needs some screenshots, depends on: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7558

/cc @ayufan @SeanPackham

See merge request !7567

Add help section for MM commands

## What should this MR do

Check @pedroms' design for the Mattermost service screen: https://gitlab.com/gitlab-org/gitlab-ce/issues/22540

Now this has to be implemented, I've created a clean canvas for you, @lbennett, to draw on.

## Does this MR meet the acceptance criteria?

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- Tests
  - [x] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !7558

Revert "Merge branch 'docs/jira-old' into 'master'"

See merge request !7531