GitLab

The following formerly separate commits have been merged in:

* Adjust 'Sign in' button for GitLab's CSRF protection

  GitLab introduced CSRF protection for authentication requests in
  571ba5a7. The 'Sign in' button has been
  adjusted to send a POST request.

* Opt out of turbolinks for 'Sign in' button

This restriction does not apply to admins.

This restriction does not apply to admins.

The project variable can hold an object which is not an instance of
Project (e.g. ProjectWiki). In this case, visibility_level is not
defined.

Additionally, the prompt to set a password is no longer shown for CAS
users.

[ci skip]

[ci skip]

[11.3] Validate LFS hrefs before downloading them

See merge request gitlab/gitlabhq!2700

[ci skip]

[11.3] Prevent a path traversal attack on global file templates

See merge request gitlab/gitlabhq!2671

[ci skip]

[11.3] Reflected XSS in OAuth Authorize window due to redirect_uri allowing arbitrary protocols

See merge request gitlab/gitlabhq!2581

[11.3] Fix CRLF issue in UrlValidator

See merge request gitlab/gitlabhq!2654

[11.3] Redact sensitive information on workhorse log

See merge request gitlab/gitlabhq!2586

[11.3] Fix SSRF in project integrations

See merge request gitlab/gitlabhq!2609

[11.3] Resolve: "Provide email notification when a user changes their email address"

See merge request gitlab/gitlabhq!2604

[11.3] Fixed ability to comment on and edit/delete comments on locked or confidential issues

See merge request gitlab/gitlabhq!2648

[11.3] [pages] Possible symlink time of check to time of use race condition

See merge request gitlab/gitlabhq!2651

[11.3] Resolve "Personal access token with only `read_user` scope can be used to authenticate any web request"

See merge request gitlab/gitlabhq!2657

6.1.1 does not include the security fix, but 6.1.2 does.

Merge branch 'security-11-3-xss-in-markdown-following-unrecognized-html-element' into 'security-11-3'

[11.3] XSS in markdown following unrecognized HTML element

See merge request gitlab/gitlabhq!2633

[11.3] Fix XSS in mermaid diagrams

See merge request gitlab/gitlabhq!2640

[11.3] Don't expose confidential information in commit message list

See merge request gitlab/gitlabhq!2644