GitLab

[ci skip]

This reverts commit 136cc132.

Preserve Orientation when removing EXIF

See merge request gitlab/gitlabhq!3045

[ci skip]

This reverts commit eccc8f05.

[ci skip]

Fix PDF.js vulnerability

See merge request gitlab/gitlabhq!3026

Disallow changing namespace of a project in update method

See merge request gitlab/gitlabhq!3031

Check label_ids parent when updating issue board

See merge request gitlab/gitlabhq!3037

Use UntrustedRegexp for CI refs matching

See merge request gitlab/gitlabhq!3008

Rake task for removing exif from uploads

See merge request gitlab/gitlabhq!3012

Fix XSS in resolve conflicts form

See merge request gitlab/gitlabhq!2988

Fix related branches visible in issues for guests

See merge request gitlab/gitlabhq!3020

Disallow guest users from accessing Releases

See merge request gitlab/gitlabhq!3044

As they do not have a permission to read git tag

Adds a rake task which can be used for removing EXIF
data from existing uploads.

- labels have to be in the same project/group
as an issuable

fix: changed PDFJS prop to GlobalWorkerOptions

Fixed pdf tests

Added changelog entry

Guest user of a project should not see branches

[ci skip]

Fix project serialization in quick actions response

See merge request gitlab/gitlabhq!3017

When executing quick actions, this limits the `commands_changes`
response to only those used by the frontend

This makes ref validation to use always `UntrustedRegexp`.
This also splits the existing RubySyntax into separate
class.

The issue arose when the branch name contained Vue template
JavaScript. The fix is to use `v-pre` which disables Vue
compilation in a template.

Sharing a public project with a private group makes the group page publicly accessible

See merge request gitlab/gitlabhq!2985

[ci skip]

Display only information visible to current user on Milestone detail

See merge request gitlab/gitlabhq!2918