Merge branch '354803-follow-up-from-add-clusters-actions-menu-to-group-and-admin-views' into 'master'

Clusters helper method refactoring

See merge request !82637

Do not disable GITLAB_USE_MODEL_LOAD_BALANCING in db:migrate:reset

See merge request gitlab-org/gitlab!83163

Fix log name to debug GitLab-Jenkins integration

See merge request gitlab-org/gitlab!83147

Anna Vovchenko authored 2 years ago and charlie ablett committed 2 years ago

As we now use the same Vue app for the cluster page on all levels,
we can clean up the clusters helper and cluster index template.
It also fixes the duplicate connect cluster button.

Changelog: fixed

Do not run smoke and reliable e2e specs twice in review pipeline

See merge request gitlab-org/gitlab!83043

Merge branch '323653-frontend-scope-a-board-to-an-iteration-cadence-and-filter-add-list-accordingly' into 'master'

Add iteration selector to board scope

See merge request !69052

Florie Guibert authored 2 years ago and Simon Knox committed 2 years ago

Changelog: changed
EE: true

Add IaC example

See merge request !83076

Complete environments `GET` API docs

See merge request !82980

Add 598.1 documentation for browser based DAST

See merge request !83063

This just re-implements what we had in
!82872 which seems
to have been reverted in
!82090 due to merge
conflict.

Update to include Project Access Token as option.

See merge request !83069

Merge branch '354600-migrate-to-shared-alert-haml-partial-in-ee-app-views-shared-billings-_eoa_bronze_plan_banner' into 'master'

Migrate alert in _eoa_bronze_plan_banner to shared global alert

See merge request !82867

Create feature flag for incremental repository backups

See merge request !79589

ci: Default to run tests with multiple databases

See merge request !82090

Remove default file pattern value

See merge request !83025

Revert "Merge branch 'andysoiron/refactor-jira-connect-dev-info' into 'master'"

See merge request !83149

Fix docs of available deployment actions

See merge request !83153

Change verificationToken field in example

See merge request !82768

Updated to match latest nav

See merge request !83142

Add limited broadcast addr to local network block list in UrlBlocker

See merge request !82571

This reverts merge request !82201

Revert reduce bundle size of the Content Editor

See merge request !83145

`UrlBlocker` protects GitLab and its users from attacks such as
Server Side Request Forgery and DNS Rebind attacks.

Until now, setting `allow_local_network` had no effect on blocking
`255.255.255.255`, whether true or false. Now, when
`allow_local_network` is set to `false` `255.255.255.255` is
blocked through the introduction of a check named
`validate_limited_broadcast_address`.

`255.255.255.255` is the "limited broadcast address", which is used to
make requests to all hosts on a local physical network [1]. Properly
configured routers won't route it. Historically it was used to wake up
offline PCs on a LAN which, since they were asleep, didn't have IP
addresses [2].

While `UrlBlocker` defaults `allow_local_network` to `true`, in
practice it is almost always `false` because of a convention to
use the GitLab configuration option which defaults to `false`.
If a GitLab administrator still wants to  reach `255.255.255.255`,
it can be added explicitly in the Allow List [3].

There is no reason a GitLab user would want to reach this, but it
could potentially be misused if an attacker finds a component
vulnerable to DNS rebinding, for example.

This commit aims to fulfil #337796

[1]: https://datatracker.ietf.org/doc/html/rfc919#section-7
[2]: https://superuser.com/a/1006951
[3]: https://docs.gitlab.com/ee/security/webhooks.html#allowlist-for-local-requests

Changelog: changed

Rename issuables_assigned_message method

See merge request !83032

Promote stable pipeline specs to reliable bucket

See merge request !83036

Render user avatar link using `GlAvatar`

See merge request !82736

Olena Horal-Koretska authored 2 years ago and Peter Hegman committed 2 years ago

The new version is behind the feature flag `gl_avatar_for_all_user_avatars`

Update SSE docs to include instructions for removal

See merge request !82234

Eric Schurter authored 2 years ago and Amy Qualls committed 2 years ago

Revise this set of steps to bring it closer to GitLab tone and style.

Adding Secure Files upload limit

See merge request !82858

Add script to recalculate project statistics build artifacts size

See merge request !81306

Erick Bajao authored 2 years ago and Bob Van Landuyt committed 2 years ago

This adds a new service and worker that refreshes the project
statistics build artifacts size and recalculates by batches.