Merge remote-tracking branch 'upstream/master'

CHANGELOG.md

@@ -2,6 +2,13 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 8.16.5 (2017-02-14)
+
+- Patch Asciidocs rendering to block XSS.
+- Fix XSS vulnerability in SVG attachments.
+- Prevent the GitHub importer from assigning labels and comments to merge requests or issues belonging to other projects.
+- Patch XSS vulnerability in RDOC support.
+
 ## 8.16.4 (2017-02-02)
 
 - Support non-ASCII characters in GFM autocomplete. !8729
@@ -174,6 +181,13 @@ entry.
 - Add margin to markdown math blocks.
 - Add hover state to MR comment reply button.
 
+## 8.15.6 (2017-02-14)
+
+- Patch Asciidocs rendering to block XSS.
+- Fix XSS vulnerability in SVG attachments.
+- Prevent the GitHub importer from assigning labels and comments to merge requests or issues belonging to other projects.
+- Patch XSS vulnerability in RDOC support.
+
 ## 8.15.4 (2017-01-09)
 
 - Make successful pipeline emails off for watchers. !8176
@@ -437,6 +451,13 @@ entry.
 - Whitelist next project names: help, ci, admin, search. !8227
 - Adds back CSS for progress-bars. !8237
 
+## 8.14.9 (2017-02-14)
+
+- Patch Asciidocs rendering to block XSS.
+- Fix XSS vulnerability in SVG attachments.
+- Prevent the GitHub importer from assigning labels and comments to merge requests or issues belonging to other projects.
+- Patch XSS vulnerability in RDOC support.
+
 ## 8.14.8 (2017-01-25)
 
 - Accept environment variables from the `pre-receive` script. !7967

app/assets/stylesheets/pages/issuable.scss

@@ -193,7 +193,6 @@
   top: $header-height;
   bottom: 0;
   right: 0;
-  z-index: 8;
   transition: width .3s;
   background: $gray-light;
   padding: 10px 20px;

app/assets/stylesheets/pages/tree.scss

@@ -171,6 +171,8 @@
 .tree-controls {
   float: right;
   margin-top: 11px;
+  position: relative;
+  z-index: 2;
 
   .project-action-button {
     margin-left: $btn-side-margin;

app/views/dashboard/_activity_head.html.haml

-%ul.nav-links
+.top-area
+  %ul.nav-links
     %li{ class: ("active" unless params[:filter]) }>
       = link_to activity_dashboard_path, class: 'shortcuts-activity', data: {placement: 'right'} do
         Your Projects

changelogs/unreleased/27631-fix-small-height-of-activity-header-page.yml

+---
+title: "Fix small height of activity header page"
+merge_request: 8952
+author: Pavel Sorokin

changelogs/unreleased/28142-overlap-bugs.yml

+---
+title: Fix z index issues with sidebar
+merge_request:
+author:

lib/gitlab/sidekiq_status/client_middleware.rb

@@ -2,7 +2,7 @@ module Gitlab
   module SidekiqStatus
     class ClientMiddleware
       def call(_, job, _, _)
-        SidekiqStatus.set(job['jid'])
+        Gitlab::SidekiqStatus.set(job['jid'])
         yield
       end
     end

lib/gitlab/sidekiq_status/server_middleware.rb

@@ -4,7 +4,7 @@ module Gitlab
       def call(worker, job, queue)
         ret = yield
 
-        SidekiqStatus.unset(job['jid'])
+        Gitlab::SidekiqStatus.unset(job['jid'])
 
         ret
       end