Remove persistent XSS vulnerability in `commit_person_link` helper

Because we were incorrectly supplying the tooltip title as
`data-original-title` (which Bootstrap's Tooltip JS automatically
applies based on the `title` attribute; we should never be setting it
directly), the value was being passed through as-is.

Instead, we should be supplying the normal `title` attribute and letting
Rails escape the value, which also negates the need for us to call
`sanitize` on it.

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15126



See merge request !1948

Signed-off-by: Rémy Coutable <remy@rymai.me>

[ci skip]

Signed-off-by: Rémy Coutable <remy@rymai.me>

[ci skip]

Signed-off-by: Rémy Coutable <remy@rymai.me>

Signed-off-by: Rémy Coutable <remy@rymai.me>

Signed-off-by: Rémy Coutable <remy@rymai.me>

Check permissions when sharing project with group

## Summary

Unprivileged user was able to share project with group he didn't have access to, and therefore gain partial access to that group, which opened possibilities for further actions like listing private projects in that group.

See https://gitlab.com/gitlab-org/gitlab-ce/issues/15330

## Fix

This change introduces additional check for group read access.

## Further work

We can think about preventing such problems in the future (this is quite common problem) by moving permissions checks to another layer of abstraction (TBD).

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/15330



See merge request !1949

Signed-off-by: Rémy Coutable <remy@rymai.me>

[ci skip]

Signed-off-by: Rémy Coutable <remy@rymai.me>

[ci skip]

Signed-off-by: Rémy Coutable <remy@rymai.me>

Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix revoking of authorized OAuth applications

Users were not able to revoke access to authorized OAuth applications. Clicking the "Revoke" button would result in a 404 page, and the application would still be authorized.

Added a spec and also found that the `gon` variables were not being set for this view.

Closes #14370

See merge request !3690

Signed-off-by: Rémy Coutable <remy@rymai.me>

Expire the exists cache before deletion to ensure project dir actually exists

See merge request !3413

Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix #14753: Check if head is born before trying to detect main language

This MR makes sure that head exists before trying to detect the main language.
This prevents errors on repo's without a master branch.

Closes #14753

See merge request !3654

In emails-on-push message, indicate message that individual file diff is too large

If a single file exceeded a diff limit, the previous implementation would just include the file as changed but the diff itself was not shown, leading to confusion:

![image](/uploads/18cd8e6b5c571305927097e1baf6097d/image.png)

Notice how the `nodes.pp` line shows no changes.

Diff overflow limits apply to different cases:

1. The entire diff exceeds 100 files OR 5000 lines
2. One single file exceeds 100 KB

Example case 2: Let's say we have a diff of 50 files, most of them under 100
KB, but one of them over that limit. In this case, the idea of
gitlab-org/gitlab-ce!2705 is that GitLab should show the diff of the 49 files
but omit the last one.

New screenshot:

![image](/uploads/9a0ac68e3deb08c28cab032fbbb80c9f/image.png)


See merge request !340

Add some additional checking for LDAP DNs in Group Sync

Based on https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/335#note_4827853, check for `uid` specifically.

cc/ @jacobvosmaer 

See merge request !339

Fix emails on push diff limit

The diff limits were not respected in the emails-on-push since the refactoring in gitlab-org/gitlab-ce!2705. This was one possible cause for customer issue described in gitlab-org/gitlab-ce#15137.

This MR also brings in the changes in !337 since they are required for this to work.

See merge request !338

Signed-off-by: Rémy Coutable <remy@rymai.me>

Concat AD group recursive member results with reguler member results

Closes #484 



See merge request !333

Merge branch 'regression-ldap-group-synchronization-is-broken-for-our-company-s-ldap-with-gitlab-8-6-442' into 'master'

Fix LDAP group sync regression for groups with member value `uid=<username>`

Closes #442 

See merge request !335

Unblocks user when active_directory is disabled and it can be found

We implemented a specific block state to handle user blocking that originates from LDAP filtering rules / directory state in !2242.

That introduced a regression in LDAP authentication when Active Directory support was disabled. You could have a scenario where the user would not be temporarily found (like a filtering rule), that would mark the user as `ldap_blocked`, but will never unblock it automatically when that state changed.

Fixes #14253, #13179, #13259, #13959

See merge request !3550

Signed-off-by: Rémy Coutable <remy@rymai.me>

Update language after doing all other operations

See merge request !3533

Signed-off-by: Rémy Coutable <remy@rymai.me>

Allow OAuth SSL verification to be disabled when importing from GitHub

Close https://gitlab.com/gitlab-org/gitlab-ee/issues/457



The SSL verification should be disabled if the GitHub Enterprise use a self signed certificate. Even disabling this on GitLab, the Git client installed in the server will perform the verification and stop the process if it is unknown. So, we need to disable Git SSL verification in the server hosting `GitLab` with the following command:

```
$ git config --global http.sslVerify false
```

/cc @balameb @ernstvn

See merge request !323

Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix 2FA authentication spoofing

## Summary

This is security fix for vulnerability described at
https://gitlab.com/gitlab-org/gitlab-ce/issues/14900

.

Attacker was able to bypass password authentication of users that have 2FA enabled, and consequently sign is as a different user, without knowing his password, if he managed to guess 2FA One Time Password for that user.

It was also possible to enumerate users and check if they have 2FA enabled, because GitLab responded with different error for each case.

## Fix

This MR attempts to change default user search scope if `otp_user_id` session variable has been set. If it is present, it means that user has 2FA enabled, and has already been verified with login and password. In this case we should look for user with `otp_user_id` first, before picking it up by `login`.

Both, 2FA authentication spoofing and 2FA discovery have been covered by specs.

## Further work

Current 2FA code is a bit tricky, so it probably needs some refactoring.

See merge request !1947

Signed-off-by: Rémy Coutable <remy@rymai.me>

Return status code 303 after a branch DELETE operation to avoid project deletion

Closes #14994

See merge request !3583

Signed-off-by: Rémy Coutable <remy@rymai.me>

Only update main language if it is not already set

Related to gitlab-org/gitlab-ce#14937 (but does not fully fix) This is a temporary fix so performance isn't affected so much.

cc @yorickpeterse @ayufan how does this look?

See merge request !3556

Signed-off-by: Rémy Coutable <remy@rymai.me>

Check permissions when importing project members

Closes #14899

See merge request !3535

Signed-off-by: Rémy Coutable <remy@rymai.me>

Fix Importing repos from GHE doesn't work

See merge request !3529

Signed-off-by: Rémy Coutable <remy@rymai.me>

[ci skip]

Signed-off-by: Rémy Coutable <remy@rymai.me>

Signed-off-by: Rémy Coutable <remy@rymai.me>

Don't fetch any tags from a forked repo

Closes #13957

See merge request !3504

Signed-off-by: Rémy Coutable <remy@rymai.me>

[ci skip]

Signed-off-by: Rémy Coutable <remy@rymai.me>