Merge branch '11-11-stable-patch-1' into '11-11-stable'

Prepare 11.11.2 release

See merge request gitlab-org/gitlab-ce!28679

29 files changed, 205 insertions, 23 deletions

diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index 2259c77c0b3..975492089e6 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-1.42.2
+1.42.3
diff --git a/app/assets/stylesheets/framework/forms.scss b/app/assets/stylesheets/framework/forms.scss
index d0f99c2df7e..4a9c73a1bc9 100644
--- a/app/assets/stylesheets/framework/forms.scss
+++ b/app/assets/stylesheets/framework/forms.scss
@@ -280,3 +280,7 @@ label {
   max-width: $input-lg-width;
   width: 100%;
 }
+
+.input-group-text {
+  max-height: $input-height;
+}
diff --git a/app/assets/stylesheets/framework/variables_overrides.scss b/app/assets/stylesheets/framework/variables_overrides.scss
index fb4d3f23cd9..ea96381a098 100644
--- a/app/assets/stylesheets/framework/variables_overrides.scss
+++ b/app/assets/stylesheets/framework/variables_overrides.scss
@@ -7,6 +7,7 @@ $secondary: $gray-light;
 $input-disabled-bg: $gray-light;
 $input-border-color: $gray-200;
 $input-color: $gl-text-color;
+$input-font-size: $gl-font-size;
 $font-family-sans-serif: $regular-font;
 $font-family-monospace: $monospace-font;
 $btn-line-height: 20px;
diff --git a/app/controllers/concerns/import_url_params.rb b/app/controllers/concerns/import_url_params.rb
index 765654ca2cb..e51e4157f50 100644
--- a/app/controllers/concerns/import_url_params.rb
+++ b/app/controllers/concerns/import_url_params.rb
@@ -2,6 +2,8 @@
 
 module ImportUrlParams
   def import_url_params
+    return {} unless params.dig(:project, :import_url).present?
+
     { import_url: import_params_to_full_url(params[:project]) }
   end
 
diff --git a/app/helpers/labels_helper.rb b/app/helpers/labels_helper.rb
index 76300e791e6..acc8aeae282 100644
--- a/app/helpers/labels_helper.rb
+++ b/app/helpers/labels_helper.rb
@@ -5,7 +5,7 @@ module LabelsHelper
   include ActionView::Helpers::TagHelper
 
   def show_label_issuables_link?(label, issuables_type, current_user: nil, project: nil)
-    return true if label.is_a?(GroupLabel)
+    return true unless label.project_label?
     return true unless project
 
     project.feature_available?(issuables_type, current_user)
@@ -159,13 +159,6 @@ module LabelsHelper
     label.subscribed?(current_user, project) ? 'Unsubscribe' : 'Subscribe'
   end
 
-  def label_deletion_confirm_text(label)
-    case label
-    when GroupLabel then _('Remove this label? This will affect all projects within the group. Are you sure?')
-    when ProjectLabel then _('Remove this label? Are you sure?')
-    end
-  end
-
   def create_label_title(subject)
     case subject
     when Group
@@ -200,7 +193,7 @@ module LabelsHelper
   end
 
   def label_status_tooltip(label, status)
-    type = label.is_a?(ProjectLabel) ? 'project' : 'group'
+    type = label.project_label? ? 'project' : 'group'
     level = status.unsubscribed? ? type : status.sub('-level', '')
     action = status.unsubscribed? ? 'Subscribe' : 'Unsubscribe'
 
diff --git a/app/presenters/label_presenter.rb b/app/presenters/label_presenter.rb
index 5227ef353c3..1077bf543d9 100644
--- a/app/presenters/label_presenter.rb
+++ b/app/presenters/label_presenter.rb
@@ -35,6 +35,14 @@ class LabelPresenter < Gitlab::View::Presenter::Delegated
     issuable_subject.is_a?(Project) && label.is_a?(GroupLabel)
   end
 
+  def project_label?
+    label.is_a?(ProjectLabel)
+  end
+
+  def subject_name
+    label.subject.name
+  end
+
   private
 
   def context_subject
diff --git a/app/views/shared/_delete_label_modal.html.haml b/app/views/shared/_delete_label_modal.html.haml
index 6bd8cadd7d9..f37dd2cdf02 100644
--- a/app/views/shared/_delete_label_modal.html.haml
+++ b/app/views/shared/_delete_label_modal.html.haml
@@ -9,7 +9,7 @@
       .modal-body
         %p
           %strong= label.name
-          %span will be permanently deleted from #{label.subject.name}. This cannot be undone.
+          %span will be permanently deleted from #{label.subject_name}. This cannot be undone.
 
       .modal-footer
         %a{ href: '#', data: { dismiss: 'modal' }, class: 'btn btn-default' } Cancel
diff --git a/app/views/shared/_label.html.haml b/app/views/shared/_label.html.haml
index 2b4a24a001f..c4b7ef481fd 100644
--- a/app/views/shared/_label.html.haml
+++ b/app/views/shared/_label.html.haml
@@ -30,7 +30,7 @@
             = sprite_icon('ellipsis_v')
           .dropdown-menu.dropdown-open-left
             %ul
-              - if label.is_a?(ProjectLabel) && label.project.group && can?(current_user, :admin_label, label.project.group)
+              - if label.project_label? && label.project.group && can?(current_user, :admin_label, label.project.group)
                 %li
                   %button.js-promote-project-label-button.btn.btn-transparent.btn-action{ disabled: true, type: 'button',
                     data: { url: promote_project_label_path(label.project, label),
diff --git a/changelogs/unreleased/60778-input-text-height.yml b/changelogs/unreleased/60778-input-text-height.yml
new file mode 100644
index 00000000000..c956ead5db2
--- /dev/null
+++ b/changelogs/unreleased/60778-input-text-height.yml
@@ -0,0 +1,5 @@
+---
+title: Fix input group height
+merge_request:
+author:
+type: other
diff --git a/changelogs/unreleased/jp-label-fix.yml b/changelogs/unreleased/jp-label-fix.yml
new file mode 100644
index 00000000000..de64286cc1f
--- /dev/null
+++ b/changelogs/unreleased/jp-label-fix.yml
@@ -0,0 +1,5 @@
+---
+title: Fix display of 'Promote to group label' button.
+merge_request:
+author:
+type: fixed
diff --git a/changelogs/unreleased/patch-64.yml b/changelogs/unreleased/patch-64.yml
new file mode 100644
index 00000000000..1bf022e7e41
--- /dev/null
+++ b/changelogs/unreleased/patch-64.yml
@@ -0,0 +1,5 @@
+---
+title: Update SAST.gitlab-ci.yml - Add SAST_GITLEAKS_ENTROPY_LEVEL
+merge_request: 28607
+author:
+type: fixed
diff --git a/changelogs/unreleased/sh-fix-import-url-update.yml b/changelogs/unreleased/sh-fix-import-url-update.yml
new file mode 100644
index 00000000000..d143bd3473a
--- /dev/null
+++ b/changelogs/unreleased/sh-fix-import-url-update.yml
@@ -0,0 +1,5 @@
+---
+title: Fix project settings not being able to update
+merge_request: 29097
+author:
+type: fixed
diff --git a/changelogs/unreleased/sh-fix-issue-58714.yml b/changelogs/unreleased/sh-fix-issue-58714.yml
new file mode 100644
index 00000000000..597a011b6f3
--- /dev/null
+++ b/changelogs/unreleased/sh-fix-issue-58714.yml
@@ -0,0 +1,5 @@
+---
+title: Fix migration failure when groups are missing route
+merge_request: 29022
+author:
+type: fixed
diff --git a/changelogs/unreleased/sh-fix-omniauth-generic-strategy.yml b/changelogs/unreleased/sh-fix-omniauth-generic-strategy.yml
new file mode 100644
index 00000000000..561c19c9685
--- /dev/null
+++ b/changelogs/unreleased/sh-fix-omniauth-generic-strategy.yml
@@ -0,0 +1,5 @@
+---
+title: Fix OmniAuth OAuth2Generic strategy not loading
+merge_request: 28680
+author:
+type: fixed
diff --git a/changelogs/unreleased/use-source-ref-name-in-webhook.yml b/changelogs/unreleased/use-source-ref-name-in-webhook.yml
new file mode 100644
index 00000000000..1a5c56d79ca
--- /dev/null
+++ b/changelogs/unreleased/use-source-ref-name-in-webhook.yml
@@ -0,0 +1,5 @@
+---
+title: Use source ref in pipeline webhook
+merge_request: 28772
+author:
+type: fixed
diff --git a/changelogs/unreleased/zj-gitlab-ce-zj-bump-gitaly.yml b/changelogs/unreleased/zj-gitlab-ce-zj-bump-gitaly.yml
new file mode 100644
index 00000000000..24fadbe3814
--- /dev/null
+++ b/changelogs/unreleased/zj-gitlab-ce-zj-bump-gitaly.yml
@@ -0,0 +1,5 @@
+---
+title: Stop two-step rebase from hanging when errors occur
+merge_request: 29068
+author:
+type: fixed
diff --git a/db/migrate/20180702134423_generate_missing_routes.rb b/db/migrate/20180702134423_generate_missing_routes.rb
index a440bc3179c..dd1106c9e6a 100644
--- a/db/migrate/20180702134423_generate_missing_routes.rb
+++ b/db/migrate/20180702134423_generate_missing_routes.rb
@@ -98,6 +98,7 @@ class GenerateMissingRoutes < ActiveRecord::Migration[4.2]
 
   class Namespace < ActiveRecord::Base
     self.table_name = 'namespaces'
+    self.inheritance_column = :_type_disabled
 
     include EachBatch
     include GenerateMissingRoutes::Routable
diff --git a/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
index 706692e063b..abf16e5b2e7 100644
--- a/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Security/SAST.gitlab-ci.yml
@@ -40,6 +40,7 @@ sast:
           SAST_BRAKEMAN_LEVEL \
           SAST_GOSEC_LEVEL \
           SAST_FLAWFINDER_LEVEL \
+          SAST_GITLEAKS_ENTROPY_LEVEL \
           SAST_DOCKER_CLIENT_NEGOTIATION_TIMEOUT \
           SAST_PULL_ANALYZER_IMAGE_TIMEOUT \
           SAST_RUN_ANALYZER_TIMEOUT \
diff --git a/lib/gitlab/data_builder/pipeline.rb b/lib/gitlab/data_builder/pipeline.rb
index fa06fb935f7..e1e813849bf 100644
--- a/lib/gitlab/data_builder/pipeline.rb
+++ b/lib/gitlab/data_builder/pipeline.rb
@@ -19,7 +19,7 @@ module Gitlab
       def hook_attrs(pipeline)
         {
           id: pipeline.id,
-          ref: pipeline.ref,
+          ref: pipeline.source_ref,
           tag: pipeline.tag,
           sha: pipeline.sha,
           before_sha: pipeline.before_sha,
diff --git a/lib/gitlab/omniauth_initializer.rb b/lib/gitlab/omniauth_initializer.rb
index e0ac9eec1f2..2a2083ebae0 100644
--- a/lib/gitlab/omniauth_initializer.rb
+++ b/lib/gitlab/omniauth_initializer.rb
@@ -36,12 +36,25 @@ module Gitlab
         hash_arguments = provider['args'].merge(provider_defaults(provider))
 
         # A Hash from the configuration will be passed as is.
-        provider_arguments << hash_arguments.symbolize_keys
+        provider_arguments << normalize_hash_arguments(hash_arguments)
       end
 
       provider_arguments
     end
 
+    def normalize_hash_arguments(args)
+      args.symbolize_keys!
+
+      # Rails 5.1 deprecated the use of string names in the middleware
+      # (https://github.com/rails/rails/commit/83b767ce), so we need to
+      # pass in the actual class to Devise.
+      if args[:strategy_class].is_a?(String)
+        args[:strategy_class] = args[:strategy_class].constantize
+      end
+
+      args
+    end
+
     def provider_defaults(provider)
       case provider['name']
       when 'cas3'
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 2a6b19d1dd4..e44f7e07e61 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -7927,12 +7927,6 @@ msgstr ""
 msgid "Remove spent time"
 msgstr ""
 
-msgid "Remove this label? Are you sure?"
-msgstr ""
-
-msgid "Remove this label? This will affect all projects within the group. Are you sure?"
-msgstr ""
-
 msgid "Remove time estimate"
 msgstr ""
 
diff --git a/spec/controllers/concerns/import_url_params_spec.rb b/spec/controllers/concerns/import_url_params_spec.rb
index fc5dfb5263f..adbe6e5d3bf 100644
--- a/spec/controllers/concerns/import_url_params_spec.rb
+++ b/spec/controllers/concerns/import_url_params_spec.rb
@@ -8,6 +8,18 @@ describe ImportUrlParams do
     controller.import_url_params
   end
 
+  context 'empty URL' do
+    let(:params) do
+      ActionController::Parameters.new(project: {
+        title: 'Test'
+      })
+    end
+
+    it 'returns empty hash' do
+      expect(import_url_params).to eq({})
+    end
+  end
+
   context 'url and password separately provided' do
     let(:params) do
       ActionController::Parameters.new(project: {
diff --git a/spec/features/projects/labels/user_promotes_label_spec.rb b/spec/features/projects/labels/user_promotes_label_spec.rb
new file mode 100644
index 00000000000..fdecafd4c50
--- /dev/null
+++ b/spec/features/projects/labels/user_promotes_label_spec.rb
@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'User promotes label' do
+  set(:group) { create(:group) }
+  set(:user) { create(:user) }
+  set(:project) { create(:project, namespace: group) }
+  set(:label) { create(:label, project: project) }
+
+  context 'when user can admin group labels' do
+    before do
+      group.add_developer(user)
+      sign_in(user)
+      visit(project_labels_path(project))
+    end
+
+    it "shows label promote button" do
+      expect(page).to have_selector('.js-promote-project-label-button')
+    end
+  end
+
+  context 'when user cannot admin group labels' do
+    before do
+      project.add_developer(user)
+      sign_in(user)
+      visit(project_labels_path(project))
+    end
+
+    it "does not show label promote button" do
+      expect(page).not_to have_selector('.js-promote-project-label-button')
+    end
+  end
+end
diff --git a/spec/features/projects/labels/user_removes_labels_spec.rb b/spec/features/projects/labels/user_removes_labels_spec.rb
index b0ce03a1c31..c231e54decd 100644
--- a/spec/features/projects/labels/user_removes_labels_spec.rb
+++ b/spec/features/projects/labels/user_removes_labels_spec.rb
@@ -21,8 +21,11 @@ describe "User removes labels" do
         page.first(".label-list-item") do
           first('.js-label-options-dropdown').click
           first(".remove-row").click
-          first(:link, "Delete label").click
         end
+
+        expect(page).to have_content("#{label.title} will be permanently deleted from #{project.name}. This cannot be undone.")
+
+        first(:link, "Delete label").click
       end
 
       expect(page).to have_content("Label was removed").and have_no_content(label.title)
diff --git a/spec/helpers/labels_helper_spec.rb b/spec/helpers/labels_helper_spec.rb
index 58eaf991d6e..314305d7a8e 100644
--- a/spec/helpers/labels_helper_spec.rb
+++ b/spec/helpers/labels_helper_spec.rb
@@ -6,7 +6,7 @@ describe LabelsHelper do
       let(:context_project) { project }
 
       context "when asking for a #{issuables_type} link" do
-        subject { show_label_issuables_link?(label, issuables_type, project: context_project) }
+        subject { show_label_issuables_link?(label.present(issuable_subject: nil), issuables_type, project: context_project) }
 
         context "when #{issuables_type} are enabled for the project" do
           let(:project) { create(:project, "#{issuables_type}_access_level": ProjectFeature::ENABLED) }
@@ -279,4 +279,21 @@ describe LabelsHelper do
       expect(label.color).to eq('bar')
     end
   end
+
+  describe '#label_status_tooltip' do
+    let(:status) { 'unsubscribed'.inquiry }
+    subject { label_status_tooltip(label.present(issuable_subject: nil), status) }
+
+    context 'with a project label' do
+      let(:label) { create(:label, title: 'bug') }
+
+      it { is_expected.to eq('Subscribe at project level') }
+    end
+
+    context 'with a group label' do
+      let(:label) { create(:group_label, title: 'bug') }
+
+      it { is_expected.to eq('Subscribe at group level') }
+    end
+  end
 end
diff --git a/spec/lib/gitlab/data_builder/pipeline_spec.rb b/spec/lib/gitlab/data_builder/pipeline_spec.rb
index 9ef987a0826..1f36fd5c6ef 100644
--- a/spec/lib/gitlab/data_builder/pipeline_spec.rb
+++ b/spec/lib/gitlab/data_builder/pipeline_spec.rb
@@ -50,5 +50,14 @@ describe Gitlab::DataBuilder::Pipeline do
       it { expect(attributes[:variables]).to be_a(Array) }
       it { expect(attributes[:variables]).to contain_exactly({ key: 'TRIGGER_KEY_1', value: 'TRIGGER_VALUE_1' }) }
     end
+
+    context 'when pipeline is a detached merge request pipeline' do
+      let(:merge_request) { create(:merge_request, :with_detached_merge_request_pipeline) }
+      let(:pipeline) { merge_request.all_pipelines.first }
+
+      it 'returns a source ref' do
+        expect(attributes[:ref]).to eq(merge_request.source_branch)
+      end
+    end
   end
 end
diff --git a/spec/lib/gitlab/omniauth_initializer_spec.rb b/spec/lib/gitlab/omniauth_initializer_spec.rb
index d808b4d49e0..f9c0daf1ef1 100644
--- a/spec/lib/gitlab/omniauth_initializer_spec.rb
+++ b/spec/lib/gitlab/omniauth_initializer_spec.rb
@@ -38,6 +38,28 @@ describe Gitlab::OmniauthInitializer do
       subject.execute([hash_config])
     end
 
+    it 'normalizes a String strategy_class' do
+      hash_config = { 'name' => 'hash', 'args' => { strategy_class: 'OmniAuth::Strategies::OAuth2Generic' } }
+
+      expect(devise_config).to receive(:omniauth).with(:hash, strategy_class: OmniAuth::Strategies::OAuth2Generic)
+
+      subject.execute([hash_config])
+    end
+
+    it 'allows a class to be specified in strategy_class' do
+      hash_config = { 'name' => 'hash', 'args' => { strategy_class: OmniAuth::Strategies::OAuth2Generic } }
+
+      expect(devise_config).to receive(:omniauth).with(:hash, strategy_class: OmniAuth::Strategies::OAuth2Generic)
+
+      subject.execute([hash_config])
+    end
+
+    it 'throws an error for an invalid strategy_class' do
+      hash_config = { 'name' => 'hash', 'args' => { strategy_class: 'OmniAuth::Strategies::Bogus' } }
+
+      expect { subject.execute([hash_config]) }.to raise_error(NameError)
+    end
+
     it 'configures fail_with_empty_uid for shibboleth' do
       shibboleth_config = { 'name' => 'shibboleth', 'args' => {} }
 
diff --git a/spec/migrations/generate_missing_routes_spec.rb b/spec/migrations/generate_missing_routes_spec.rb
index 32515d353b0..30ad135d4df 100644
--- a/spec/migrations/generate_missing_routes_spec.rb
+++ b/spec/migrations/generate_missing_routes_spec.rb
@@ -8,7 +8,7 @@ describe GenerateMissingRoutes, :migration do
     let(:routes) { table(:routes) }
 
     it 'creates routes for projects without a route' do
-      namespace = namespaces.create!(name: 'GitLab', path: 'gitlab')
+      namespace = namespaces.create!(name: 'GitLab', path: 'gitlab', type: 'Group')
 
       routes.create!(
         path: 'gitlab',
diff --git a/spec/presenters/label_presenter_spec.rb b/spec/presenters/label_presenter_spec.rb
index fae8188670f..d566da7c872 100644
--- a/spec/presenters/label_presenter_spec.rb
+++ b/spec/presenters/label_presenter_spec.rb
@@ -62,4 +62,32 @@ describe LabelPresenter do
       expect(label.can_subscribe_to_label_in_different_levels?).to be_falsey
     end
   end
+
+  describe '#project_label?' do
+    context 'with group label' do
+      subject { group_label.project_label? }
+
+      it { is_expected.to be_falsey }
+    end
+
+    context 'with project label' do
+      subject { label.project_label? }
+
+      it { is_expected.to be_truthy }
+    end
+  end
+
+  describe '#subject_name' do
+    context 'with group label' do
+      subject { group_label.subject_name }
+
+      it { is_expected.to eq(group_label.group.name) }
+    end
+
+    context 'with project label' do
+      subject { label.subject_name }
+
+      it { is_expected.to eq(label.project.name) }
+    end
+  end
 end