CHANGELOG-EE.md

 Please view this file on the master branch, on stable branches it's out of date.
 
+## 12.9.3 (2020-04-14)
+
+### Security (1 change)
+
+- Fix filename bypass when uploading NuGet packages.
+
+
 ## 12.9.2 (2020-03-31)
 
 ### Fixed (4 changes)
@@ -152,6 +159,13 @@ Please view this file on the master branch, on stable branches it's out of date.
 - Allow users to be marked as service users. !202680
 
 
+## 12.8.9 (2020-04-14)
+
+### Security (1 change)
+
+- Fix filename bypass when uploading NuGet packages.
+
+
 ## 12.8.7 (2020-03-16)
 
 ### Fixed (1 change)
@@ -305,6 +319,13 @@ Please view this file on the master branch, on stable branches it's out of date.
 - Prepare DB structure for GMA forking changes. !22002
 
 
+## 12.7.9 (2020-04-14)
+
+### Security (1 change)
+
+- Fix filename bypass when uploading NuGet packages.
+
+
 ## 12.7.5
 
 ### Fixed (1 change)

CHANGELOG.md

@@ -2,6 +2,15 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
+## 12.9.3 (2020-04-14)
+
+### Security (3 changes)
+
+- Refresh ProjectAuthorization during Group deletion.
+- Prevent filename bypass on artifact upload.
+- Update rack and related gems to 2.0.9 to fix security issue.
+
+
 ## 12.9.2 (2020-03-31)
 ### Fixed (5 changes)
@@ -499,6 +508,15 @@ entry.
 - Improvement in token reference.
+## 12.8.9 (2020-04-14)
+
+### Security (3 changes)
+
+- Refresh ProjectAuthorization during Group deletion.
+- Prevent filename bypass on artifact upload.
+- Update rack and related gems to 2.0.9 to fix security issue.
+
+
 ## 12.8.7 (2020-03-16)
 ### Fixed (1 change, 1 of them is from the community)
@@ -1089,6 +1107,15 @@ entry.
 - Add clarifying content to account fields.
+## 12.7.9 (2020-04-14)
+
+### Security (3 changes)
+
+- Refresh ProjectAuthorization during Group deletion.
+- Prevent filename bypass on artifact upload.
+- Update rack and related gems to 2.0.9 to fix security issue.
+
+
 ## 12.7.5
 ### Fixed (4 changes, 1 of them is from the community)

GITLAB_WORKHORSE_VERSION

-8.30.0
+8.30.1

Gemfile

@@ -163,7 +163,7 @@ gem 'diffy', '~> 3.3'
 gem 'diff_match_patch', '~> 0.1.0'
 
 # Application server
-gem 'rack', '~> 2.0.7'
+gem 'rack', '~> 2.0.9'
 
 group :unicorn do
   gem 'unicorn', '~> 5.4.1'

Gemfile.lock

@@ -173,7 +173,7 @@ GEM
     concord (0.1.5)
       adamantium (~> 0.2.0)
       equalizer (~> 0.0.9)
-    concurrent-ruby (1.1.5)
+    concurrent-ruby (1.1.6)
     connection_pool (2.2.2)
     contracts (0.11.0)
     cork (0.3.0)
@@ -788,7 +788,7 @@ GEM
     public_suffix (4.0.3)
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.1.6)
-    rack (2.0.7)
+    rack (2.0.9)
     rack-accept (0.4.5)
       rack (>= 0.4)
     rack-attack (6.2.0)
@@ -859,17 +859,17 @@ GEM
       json
     recursive-open-struct (1.1.0)
     redis (4.1.3)
-    redis-actionpack (5.1.0)
-      actionpack (>= 4.0, < 7)
-      redis-rack (>= 1, < 3)
+    redis-actionpack (5.2.0)
+      actionpack (>= 5, < 7)
+      redis-rack (>= 2.1.0, < 3)
       redis-store (>= 1.1.0, < 2)
     redis-activesupport (5.2.0)
       activesupport (>= 3, < 7)
       redis-store (>= 1.3, < 2)
     redis-namespace (1.6.0)
       redis (>= 3.0.4)
-    redis-rack (2.0.6)
-      rack (>= 1.5, < 3)
+    redis-rack (2.1.2)
+      rack (>= 2.0.8, < 3)
       redis-store (>= 1.2, < 2)
     redis-rails (5.0.2)
       redis-actionpack (>= 5.0, < 6)
@@ -1331,7 +1331,7 @@ DEPENDENCIES
   prometheus-client-mmap (~> 0.10.0)
   pry-byebug (~> 3.5.1)
   pry-rails (~> 0.3.9)
-  rack (~> 2.0.7)
+  rack (~> 2.0.9)
   rack-attack (~> 6.2.0)
   rack-cors (~> 1.0.6)
   rack-oauth2 (~> 1.9.3)

app/assets/javascripts/alerts_service_settings/components/alerts_service_form.vue

@@ -6,7 +6,7 @@ import {
   GlModal,
   GlModalDirective,
 } from '@gitlab/ui';
-import _ from 'underscore';
+import { escape as esc } from 'lodash';
 import ClipboardButton from '~/vue_shared/components/clipboard_button.vue';
 import ToggleButton from '~/vue_shared/components/toggle_button.vue';
 import axios from '~/lib/utils/axios_utils';
@@ -65,7 +65,7 @@ export default {
           'AlertService|%{linkStart}Learn more%{linkEnd} about configuring this endpoint to receive alerts.',
         ),
         {
-          linkStart: `<a href="${_.escape(
+          linkStart: `<a href="${esc(
             this.learnMoreUrl,
           )}" target="_blank" rel="noopener noreferrer">`,
           linkEnd: '</a>',

app/assets/javascripts/api.js

@@ -188,6 +188,15 @@ const Api = {
     return axios.get(url, { params });
   },
 
+  createProjectMergeRequest(projectPath, options) {
+    const url = Api.buildUrl(Api.projectMergeRequestsPath).replace(
+      ':id',
+      encodeURIComponent(projectPath),
+    );
+
+    return axios.post(url, options);
+  },
+
   // Return Merge Request for project
   projectMergeRequest(projectPath, mergeRequestId, params = {}) {
     const url = Api.buildUrl(Api.projectMergeRequestPath)

app/assets/javascripts/badges/components/badge_list.vue

@@ -28,7 +28,7 @@ export default {
       {{ s__('Badges|Your badges') }}
       <span v-show="!isLoading" class="badge badge-pill">{{ badges.length }}</span>
     </div>
-    <gl-loading-icon v-show="isLoading" :size="2" class="card-body" />
+    <gl-loading-icon v-show="isLoading" size="lg" class="card-body" />
     <div v-if="hasNoBadges" class="card-body">
       <span v-if="isGroupBadge">{{ s__('Badges|This group has no badges') }}</span>
       <span v-else>{{ s__('Badges|This project has no badges') }}</span>

app/assets/javascripts/ci_variable_list/components/ci_variable_modal.vue

@@ -65,12 +65,6 @@ export default {
     modalActionText() {
       return this.variableBeingEdited ? __('Update variable') : __('Add variable');
     },
-    primaryAction() {
-      return {
-        text: this.modalActionText,
-        attributes: { variant: 'success', disabled: !this.canSubmit },
-      };
-    },
     maskedFeedback() {
       return __('This variable can not be masked');
     },
@@ -120,6 +114,8 @@ export default {
     ref="modal"
     :modal-id="$options.modalId"
     :title="modalActionText"
+    static
+    lazy
     @hidden="resetModalHandler"
   >
     <form>
@@ -127,7 +123,7 @@ export default {
         <gl-form-input
           id="ci-variable-key"
           v-model="variableData.key"
-          data-qa-selector="variable_key"
+          data-qa-selector="ci_variable_key_field"
         />
       </gl-form-group>
 
@@ -142,7 +138,7 @@ export default {
           v-model="variableData.secret_value"
           rows="3"
           max-rows="6"
-          data-qa-selector="variable_value"
+          data-qa-selector="ci_variable_value_field"
         />
       </gl-form-group>
 
@@ -189,7 +185,7 @@ export default {
         <gl-form-checkbox
           ref="masked-ci-variable"
           v-model="variableData.masked"
-          data-qa-selector="variable_masked"
+          data-qa-selector="ci_variable_masked_checkbox"
         >
           {{ __('Mask variable') }}
           <gl-link href="/help/ci/variables/README#masked-variables">
@@ -218,6 +214,7 @@ export default {
         ref="deleteCiVariable"
         category="secondary"
         variant="danger"
+        data-qa-selector="ci_variable_delete_button"
         @click="deleteVarAndClose"
         >{{ __('Delete variable') }}</gl-deprecated-button
       >
@@ -225,6 +222,7 @@ export default {
         ref="updateOrAddVariable"
         :disabled="!canSubmit"
         variant="success"
+        data-qa-selector="ci_variable_save_button"
         @click="updateOrAddVariable"
         >{{ modalActionText }}
       </gl-deprecated-button>

app/assets/javascripts/ci_variable_list/components/ci_variable_table.vue

@@ -26,7 +26,6 @@ export default {
     {
       key: 'value',
       label: s__('CiVariables|Value'),
-      tdClass: 'qa-ci-variable-input-value',
       customStyle: { width: '40%' },
     },
     {
@@ -89,6 +88,7 @@ export default {
       :fields="fields"
       :items="variables"
       tbody-tr-class="js-ci-variable-row"
+      data-qa-selector="ci_variable_table_content"
       sort-by="key"
       sort-direction="asc"
       stacked="lg"
@@ -150,6 +150,7 @@ export default {
         <gl-deprecated-button
           ref="edit-ci-variable"
           v-gl-modal-directive="$options.modalId"
+          data-qa-selector="edit_ci_variable_button"
           @click="editVariable(item)"
         >
           <gl-icon :size="$options.iconSize" name="pencil" />
@@ -168,7 +169,7 @@ export default {
       <gl-deprecated-button
         v-if="tableIsNotEmpty"
         ref="secret-value-reveal-button"
-        data-qa-selector="reveal_ci_variable_value"
+        data-qa-selector="reveal_ci_variable_value_button"
         class="append-right-8"
         @click="toggleValues(!valuesHidden)"
         >{{ valuesButtonText }}</gl-deprecated-button
@@ -176,7 +177,7 @@ export default {
       <gl-deprecated-button
         ref="add-ci-variable"
         v-gl-modal-directive="$options.modalId"
-        data-qa-selector="add_ci_variable"
+        data-qa-selector="add_ci_variable_button"
         variant="success"
         >{{ __('Add Variable') }}</gl-deprecated-button
       >

app/assets/javascripts/contributors/components/contributors.vue

@@ -197,7 +197,7 @@ export default {
 <template>
   <div>
     <div v-if="loading" class="contributors-loader text-center">
-      <gl-loading-icon :inline="true" :size="4" />
+      <gl-loading-icon :inline="true" size="xl" />
     </div>
 
     <div v-else-if="showChart" class="contributors-charts">

app/assets/javascripts/create_item_dropdown.js

-import _ from 'underscore';
+import { escape as esc } from 'lodash';
 import '~/gl_dropdown';
 
 export default class CreateItemDropdown {
@@ -37,14 +37,14 @@ export default class CreateItemDropdown {
       },
       selectable: true,
       toggleLabel(selected) {
-        return selected && 'id' in selected ? _.escape(selected.title) : this.defaultToggleLabel;
+        return selected && 'id' in selected ? esc(selected.title) : this.defaultToggleLabel;
       },
       fieldName: this.fieldName,
       text(item) {
-        return _.escape(item.text);
+        return esc(item.text);
       },
       id(item) {
-        return _.escape(item.id);
+        return esc(item.id);
       },
       onFilter: this.toggleCreateNewButton.bind(this),
       clicked: options => {

app/assets/javascripts/deploy_keys/components/app.vue

@@ -119,7 +119,7 @@ export default {
     <gl-loading-icon
       v-if="isLoading && !hasKeys"
       :label="s__('DeployKeys|Loading deploy keys')"
-      :size="2"
+      size="lg"
     />
     <template v-else-if="hasKeys">
       <div class="top-area scrolling-tabs-container inner-page-scroll-tabs">

app/assets/javascripts/environments/components/environment_item.vue

@@ -58,12 +58,6 @@ export default {
       required: true,
     },
 
-    shouldShowAutoStopDate: {
-      type: Boolean,
-      required: false,
-      default: false,
-    },
-
     tableData: {
       type: Object,
       required: true,
@@ -638,12 +632,7 @@ export default {
       </span>
     </div>
 
-    <div
-      v-if="!isFolder && shouldShowAutoStopDate"
-      class="table-section"
-      :class="tableData.autoStop.spacing"
-      role="gridcell"
-    >
+    <div v-if="!isFolder" class="table-section" :class="tableData.autoStop.spacing" role="gridcell">
       <div role="rowheader" class="table-mobile-header">{{ tableData.autoStop.title }}</div>
       <span
         v-if="canShowAutoStopDate"
@@ -662,10 +651,7 @@ export default {
       role="gridcell"
     >
       <div class="btn-group table-action-buttons" role="group">
-        <pin-component
-          v-if="canShowAutoStopDate && shouldShowAutoStopDate"
-          :auto-stop-url="autoStopUrl"
-        />
+        <pin-component v-if="canShowAutoStopDate" :auto-stop-url="autoStopUrl" />
 
         <external-url-component
           v-if="externalURL && canReadEnvironment"

app/assets/javascripts/environments/components/environments_table.vue

@@ -6,7 +6,6 @@ import { GlLoadingIcon } from '@gitlab/ui';
 import { flow, reverse, sortBy } from 'lodash/fp';
 import environmentTableMixin from 'ee_else_ce/environments/mixins/environments_table_mixin';
 import { s__ } from '~/locale';
-import glFeatureFlagsMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import EnvironmentItem from './environment_item.vue';
 
 export default {
@@ -17,7 +16,7 @@ export default {
     CanaryDeploymentCallout: () =>
       import('ee_component/environments/components/canary_deployment_callout.vue'),
   },
-  mixins: [environmentTableMixin, glFeatureFlagsMixin()],
+  mixins: [environmentTableMixin],
   props: {
     environments: {
       type: Array,
@@ -43,9 +42,6 @@ export default {
           : env,
       );
     },
-    shouldShowAutoStopDate() {
-      return this.glFeatures.autoStopEnvironments;
-    },
     tableData() {
       return {
         // percent spacing for cols, should add up to 100
@@ -74,7 +70,7 @@ export default {
           spacing: 'section-5',
         },
         actions: {
-          spacing: this.shouldShowAutoStopDate ? 'section-25' : 'section-30',
+          spacing: 'section-25',
         },
       };
     },
@@ -131,12 +127,7 @@ export default {
       <div class="table-section" :class="tableData.date.spacing" role="columnheader">
         {{ tableData.date.title }}
       </div>
-      <div
-        v-if="shouldShowAutoStopDate"
-        class="table-section"
-        :class="tableData.autoStop.spacing"
-        role="columnheader"
-      >
+      <div class="table-section" :class="tableData.autoStop.spacing" role="columnheader">
         {{ tableData.autoStop.title }}
       </div>
     </div>
@@ -146,7 +137,6 @@ export default {
         :key="`environment-item-${i}`"
         :model="model"
         :can-read-environment="canReadEnvironment"
-        :should-show-auto-stop-date="shouldShowAutoStopDate"
         :table-data="tableData"
       />
 

app/assets/javascripts/error_tracking/components/error_details.vue

@@ -225,7 +225,7 @@ export default {
 <template>
   <div>
     <div v-if="errorLoading" class="py-3">
-      <gl-loading-icon :size="3" />
+      <gl-loading-icon size="lg" />
     </div>
     <div v-else-if="error" class="error-details">
       <gl-alert v-if="isAlertVisible" @dismiss="isAlertVisible = false">
@@ -405,7 +405,7 @@ export default {
         </ul>
 
         <div v-if="loadingStacktrace" class="py-3">
-          <gl-loading-icon :size="3" />
+          <gl-loading-icon size="lg" />
         </div>
 
         <template v-else-if="showStacktrace">

app/assets/javascripts/frequent_items/components/app.vue

@@ -107,7 +107,7 @@ export default {
     <gl-loading-icon
       v-if="isLoadingItems"
       :label="translations.loadingMessage"
-      :size="2"
+      size="lg"
       class="loading-animation prepend-top-20"
     />
     <div v-if="!isLoadingItems && !hasSearchQuery" class="section-header">

app/assets/javascripts/ide/components/branches/search_list.vue

@@ -72,7 +72,7 @@ export default {
     <div class="dropdown-content ide-merge-requests-dropdown-content d-flex">
       <gl-loading-icon
         v-if="isLoading"
-        :size="2"
+        size="lg"
         class="mt-3 mb-3 align-self-center ml-auto mr-auto"
       />
       <ul v-else class="mb-0 w-100">

app/assets/javascripts/ide/components/file_templates/dropdown.vue

@@ -88,7 +88,7 @@ export default {
         <i aria-hidden="true" class="fa fa-search dropdown-input-search"></i>
       </div>
       <div class="dropdown-content">
-        <gl-loading-icon v-if="showLoading" :size="2" />
+        <gl-loading-icon v-if="showLoading" size="lg" />
         <ul v-else>
           <li v-for="(item, index) in outputData" :key="index">
             <button type="button" @click="clickItem(item)">{{ item.name }}</button>

app/assets/javascripts/ide/components/jobs/list.vue

@@ -26,7 +26,7 @@ export default {
 
 <template>
   <div>
-    <gl-loading-icon v-if="loading && !stages.length" :size="2" class="prepend-top-default" />
+    <gl-loading-icon v-if="loading && !stages.length" size="lg" class="prepend-top-default" />
     <template v-else>
       <stage
         v-for="stage in stages"