[merge-train skip]

[ci skip]

Prepare 15.11.7 release for gitlab-jh

See merge request gitlab-cn/gitlab!1719

Mayra Cabrera authored 1 year ago and Wenju Liu committed 1 year ago

Quarantine projects_finder_spec

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/122226



Merged-by: Mayra Cabrera <mcabrera@gitlab.com>
Approved-by: Mayra Cabrera <mcabrera@gitlab.com>
Co-authored-by: Jennifer Li <jli@gitlab.com>

[merge-train skip]

[ci skip]

[ci skip]

Fix DoS on test report artifacts

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3200



Merged-by: Jenny Kim <yjeankim@gitlab.com>
Approved-by: Ethan Urie <eurie@gitlab.com>
Approved-by: Félix Veillette-Potvin <fveillette@gitlab.com>
Co-authored-by: Dmytro Biryukov <dbiryukov@gitlab.com>

Merge branch 'security-fix-DoS-on-test-report-artifacts_mr-850-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3200

Changelog: security

Fix XSS in Abuse Reports form action

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3290



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Jessie Young <jessieyoung@gitlab.com>
Co-authored-by: Dheeraj Joshi <djoshi@gitlab.com>

Merge branch 'security-xss-abuse-reports-url-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3290

Changelog: security

Escape the source branch link correctly

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3288



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Peter Leitzen <pleitzen@gitlab.com>
Co-authored-by: Dheeraj Joshi <djoshi@gitlab.com>

Merge branch 'security-xss-merge-request-fork-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3288

Changelog: security

Import source owners with maintainer access if importer is a maintainer

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3283



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Tetiana Chupryna <tchupryna@gitlab.com>
Co-authored-by: Abdul Wadood <awadood@gitlab.com>

Merge branch 'security-892-importing-members-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3283

Changelog: security

Filter inaccessible issuable notes when exporting project

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3274



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Max Woolf <mwoolf@gitlab.com>
Co-authored-by: Eugenia Grieff <egrieff@gitlab.com>

Merge branch 'security-cross-group-child-issues-export-notes-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3274

Changelog: security

Block tag names that are prepended with refs/tags/, due to conflicts

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3262



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Vasilii Iakliushin <viakliushin@gitlab.com>
Co-authored-by: Robert May <rmay@gitlab.com>

Merge branch 'security-406764-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3262

Changelog: security

Set IP in ActionContoller filter before IP enforcement is evaluated

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3279



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Stan Hu <stanhu@gmail.com>
Co-authored-by: Imre Farkas <ifarkas@gitlab.com>

Merge branch 'security-407891-ip_enforcement_for_public_projects-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3279

Changelog: security

Merge branch 'security-dblessing_fix_unverified_primary_email_commit_public-15-11' into '15-11-stable-ee'

Prevent primary email returned as verified on unsaved change

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3223



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Allen Cook <acook@gitlab.com>
Co-authored-by: Drew Blessing <drew@gitlab.com>

Merge branch 'security-dblessing_fix_unverified_primary_email_commit_public-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3223

Changelog: security

Use UntrustedRegexp to protect FrontMatter filter

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3257



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Etienne Baqué <ebaque@gitlab.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Merge branch 'security-untrusted-front-matter-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3257

Changelog: security

Improve ambiguous_ref? logic to include heads and tags

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3247



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Vasilii Iakliushin <viakliushin@gitlab.com>
Co-authored-by: Joe Woodward <jwoodward@gitlab.com>

Merge branch 'security-security/406844-ambiguous-branch-name-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3247

Changelog: security

Use UntrustedRegexp to protect InlineDiff filter

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3254



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Rajendra Kadam <rkadam@gitlab.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Merge branch 'security-untrusted-inlinediff-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3254

Changelog: security

Ignore user-defined diff paths in diff notes

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3267



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Phil Hughes <me@iamphill.com>
Co-authored-by: Jacques <jerasmus@gitlab.com>

Merge branch 'security-prevent-diff-for-path-vulnerability-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3267

Changelog: security

Reject NPM metadata requests with invalid package_name

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3285



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: David Fernandez <dfernandez@gitlab.com>
Co-authored-by: Radamanthus Batnag <rbatnag@gitlab.com>

Merge branch 'security-fix-open-redirection-npm-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3285

Changelog: security

Use UntrustedRegexp to protect MathFilter regex

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3251



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Kerri Miller <kerrizor@kerrizor.com>
Co-authored-by: Brett Walker <bwalker@gitlab.com>

Merge branch 'security-untrusted-math-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3251

Changelog: security

Resolve Overall Project Vulnerability Disclosure

See merge request https://gitlab.com/gitlab-org/security/gitlab/-/merge_requests/3230



Merged-by: GitLab Release Tools Bot <delivery-team+release-tools@gitlab.com>
Approved-by: Allen Cook <acook@gitlab.com>
Co-authored-by: Gregory <11164960-ghavenga@users.noreply.gitlab.com>

Merge branch 'security-390840-confidential-issue-15-11' into '15-11-stable-ee'

See merge request gitlab-org/security/gitlab!3230

Changelog: security