Add latest changes from gitlab-org/gitlab@master

30 files changed, 279 insertions, 149 deletions

diff --git a/CHANGELOG-EE.md b/CHANGELOG-EE.md
index 9226e23795b..5ba1528d8dd 100644
--- a/CHANGELOG-EE.md
+++ b/CHANGELOG-EE.md
@@ -1,5 +1,12 @@
 Please view this file on the master branch, on stable branches it's out of date.
 
+## 12.5.4
+
+### Security (1 change)
+
+- Fix stale Elasticsearch permissions when moving group from public group to private parent group.
+
+
 ## 12.5.3
 
 ### Performance (1 change)
@@ -251,6 +258,13 @@ Please view this file on the master branch, on stable branches it's out of date.
 - Docs for protected branch code owner approval API. !17132
 
 
+## 12.3.9
+
+### Security (1 change)
+
+- Fix stale Elasticsearch permissions when moving group from public group to private parent group.
+
+
 ## 12.3.7
 
 ### Security (6 changes)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5c550c8c9db..7761d9ed0ec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,13 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 12.5.4
+
+### Security (1 change)
+
+- Update maven_file_name_regex for full string match.
+
+
 ## 12.5.3
 
 ### Fixed (4 changes)
@@ -756,6 +763,13 @@ entry.
 - Remove Postgresql specific setup tasks and move to schema.rb.
 
 
+## 12.3.9
+
+### Security (1 change)
+
+- Update maven_file_name_regex for full string match.
+
+
 ## 12.3.7
 
 ### Security (12 changes)
diff --git a/app/helpers/award_emoji_helper.rb b/app/helpers/award_emoji_helper.rb
index 4bc5a7b090e..13df53a751b 100644
--- a/app/helpers/award_emoji_helper.rb
+++ b/app/helpers/award_emoji_helper.rb
@@ -7,7 +7,7 @@ module AwardEmojiHelper
     if awardable.is_a?(Note)
       # We render a list of notes very frequently and calling the specific method is a lot faster than the generic one (4.5x)
       if awardable.for_personal_snippet?
-        toggle_award_emoji_snippet_note_path(awardable.noteable, awardable)
+        gitlab_toggle_award_emoji_snippet_note_path(awardable.noteable, awardable)
       else
         toggle_award_emoji_project_note_path(@project, awardable.id)
       end
diff --git a/app/helpers/blob_helper.rb b/app/helpers/blob_helper.rb
index 656e6039dbd..c9fb28d0299 100644
--- a/app/helpers/blob_helper.rb
+++ b/app/helpers/blob_helper.rb
@@ -141,7 +141,7 @@ module BlobHelper
     if @build && @entry
       raw_project_job_artifacts_url(@project, @build, path: @entry.path, **kwargs)
     elsif @snippet
-      raw_snippet_url(@snippet)
+      gitlab_raw_snippet_url(@snippet)
     elsif @blob
       project_raw_url(@project, @id, **kwargs)
     end
diff --git a/app/helpers/gitlab_routing_helper.rb b/app/helpers/gitlab_routing_helper.rb
index 3810041b2af..78c41257404 100644
--- a/app/helpers/gitlab_routing_helper.rb
+++ b/app/helpers/gitlab_routing_helper.rb
@@ -194,88 +194,84 @@ module GitlabRoutingHelper
     take_ownership_project_pipeline_schedule_path(project, schedule, *args)
   end
 
-  def snippet_path(snippet, *args)
-    if snippet.type == "ProjectSnippet"
-      application_url_helpers.project_snippet_path(snippet.project, snippet, *args)
+  def gitlab_snippet_path(snippet, *args)
+    if snippet.is_a?(ProjectSnippet)
+      project_snippet_path(snippet.project, snippet, *args)
     else
       new_args = snippet_query_params(snippet, *args)
-      application_url_helpers.snippet_path(snippet, *new_args)
+      snippet_path(snippet, *new_args)
     end
   end
 
-  def snippet_url(snippet, *args)
-    if snippet.type == "ProjectSnippet"
-      application_url_helpers.project_snippet_url(snippet.project, snippet, *args)
+  def gitlab_snippet_url(snippet, *args)
+    if snippet.is_a?(ProjectSnippet)
+      project_snippet_url(snippet.project, snippet, *args)
     else
       new_args = snippet_query_params(snippet, *args)
-      application_url_helpers.snippet_url(snippet, *new_args)
+      snippet_url(snippet, *new_args)
     end
   end
 
-  def raw_snippet_path(snippet, *args)
-    if snippet.type == "ProjectSnippet"
-      application_url_helpers.raw_project_snippet_path(snippet.project, snippet, *args)
+  def gitlab_raw_snippet_path(snippet, *args)
+    if snippet.is_a?(ProjectSnippet)
+      raw_project_snippet_path(snippet.project, snippet, *args)
     else
       new_args = snippet_query_params(snippet, *args)
-      application_url_helpers.raw_snippet_path(snippet, *new_args)
+      raw_snippet_path(snippet, *new_args)
     end
   end
 
-  def raw_snippet_url(snippet, *args)
-    if snippet.type == "ProjectSnippet"
-      application_url_helpers.raw_project_snippet_url(snippet.project, snippet, *args)
+  def gitlab_raw_snippet_url(snippet, *args)
+    if snippet.is_a?(ProjectSnippet)
+      raw_project_snippet_url(snippet.project, snippet, *args)
     else
       new_args = snippet_query_params(snippet, *args)
-      application_url_helpers.raw_snippet_url(snippet, *new_args)
+      raw_snippet_url(snippet, *new_args)
     end
   end
 
-  def snippet_notes_path(snippet, *args)
+  def gitlab_snippet_notes_path(snippet, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.snippet_notes_path(snippet, *new_args)
+    snippet_notes_path(snippet, *new_args)
   end
 
-  def snippet_notes_url(snippet, *args)
+  def gitlab_snippet_notes_url(snippet, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.snippet_notes_url(snippet, *new_args)
+    snippet_notes_url(snippet, *new_args)
   end
 
-  def snippet_note_path(snippet, note, *args)
+  def gitlab_snippet_note_path(snippet, note, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.snippet_note_path(snippet, note, *new_args)
+    snippet_note_path(snippet, note, *new_args)
   end
 
-  def snippet_note_url(snippet, note, *args)
+  def gitlab_snippet_note_url(snippet, note, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.snippet_note_url(snippet, note, *new_args)
+    snippet_note_url(snippet, note, *new_args)
   end
 
-  def toggle_award_emoji_snippet_note_path(snippet, note, *args)
+  def gitlab_toggle_award_emoji_snippet_note_path(snippet, note, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.toggle_award_emoji_snippet_note_path(snippet, note, *new_args)
+    toggle_award_emoji_snippet_note_path(snippet, note, *new_args)
   end
 
-  def toggle_award_emoji_snippet_note_url(snippet, note, *args)
+  def gitlab_toggle_award_emoji_snippet_note_url(snippet, note, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.toggle_award_emoji_snippet_note_url(snippet, note, *new_args)
+    toggle_award_emoji_snippet_note_url(snippet, note, *new_args)
   end
 
-  def toggle_award_emoji_snippet_path(snippet, *args)
+  def gitlab_toggle_award_emoji_snippet_path(snippet, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.toggle_award_emoji_snippet_path(snippet, *new_args)
+    toggle_award_emoji_snippet_path(snippet, *new_args)
   end
 
-  def toggle_award_emoji_snippet_url(snippet, *args)
+  def gitlab_toggle_award_emoji_snippet_url(snippet, *args)
     new_args = snippet_query_params(snippet, *args)
-    application_url_helpers.toggle_award_emoji_snippet_url(snippet, *new_args)
+    toggle_award_emoji_snippet_url(snippet, *new_args)
   end
 
   private
 
-  def application_url_helpers
-    Gitlab::Routing.url_helpers
-  end
-
   def snippet_query_params(snippet, *args)
     opts = case args.last
            when Hash
diff --git a/app/helpers/issuables_helper.rb b/app/helpers/issuables_helper.rb
index 18451bc5273..8c75a4a13e8 100644
--- a/app/helpers/issuables_helper.rb
+++ b/app/helpers/issuables_helper.rb
@@ -279,19 +279,30 @@ module IssuablesHelper
       initialDescriptionText: issuable.description,
       initialTaskStatus: issuable.task_status
     }
+    data.merge!(issue_only_initial_data(issuable))
+    data.merge!(path_data(parent))
+    data.merge!(updated_at_by(issuable))
 
-    data[:hasClosingMergeRequest] = issuable.merge_requests_count(current_user) != 0 if issuable.is_a?(Issue)
-    data[:zoomMeetingUrl] = ZoomMeeting.canonical_meeting_url(issuable) if issuable.is_a?(Issue)
+    data
+  end
 
-    if parent.is_a?(Group)
-      data[:groupPath] = parent.path
-    else
-      data.merge!(projectPath: ref_project.path, projectNamespace: ref_project.namespace.full_path)
-    end
+  def issue_only_initial_data(issuable)
+    return {} unless issuable.is_a?(Issue)
 
-    data.merge!(updated_at_by(issuable))
+    {
+      hasClosingMergeRequest: issuable.merge_requests_count(current_user) != 0,
+      zoomMeetingUrl: ZoomMeeting.canonical_meeting_url(issuable),
+      sentryIssueIdentifier: SentryIssue.find_by(issue: issuable)&.sentry_issue_identifier # rubocop:disable CodeReuse/ActiveRecord
+    }
+  end
 
-    data
+  def path_data(parent)
+    return { groupPath: parent.path } if parent.is_a?(Group)
+
+    {
+        projectPath: ref_project.path,
+        projectNamespace: ref_project.namespace.full_path
+    }
   end
 
   def updated_at_by(issuable)
diff --git a/app/helpers/notes_helper.rb b/app/helpers/notes_helper.rb
index fbbdebaa623..acf9f8c5b5b 100644
--- a/app/helpers/notes_helper.rb
+++ b/app/helpers/notes_helper.rb
@@ -95,7 +95,7 @@ module NotesHelper
 
   def notes_url(params = {})
     if @snippet.is_a?(PersonalSnippet)
-      snippet_notes_path(@snippet, params)
+      gitlab_snippet_notes_path(@snippet, params)
     else
       params.merge!(target_id: @noteable.id, target_type: @noteable.class.name.underscore)
 
@@ -105,7 +105,7 @@ module NotesHelper
 
   def note_url(note, project = @project)
     if note.noteable.is_a?(PersonalSnippet)
-      snippet_note_path(note.noteable, note)
+      gitlab_snippet_note_path(note.noteable, note)
     else
       project_note_path(project, note)
     end
@@ -126,7 +126,7 @@ module NotesHelper
   def new_form_url
     return unless @snippet.is_a?(PersonalSnippet)
 
-    snippet_notes_path(@snippet)
+    gitlab_snippet_notes_path(@snippet)
   end
 
   def can_create_note?
diff --git a/app/helpers/snippets_helper.rb b/app/helpers/snippets_helper.rb
index 7d7d8646c25..7b93d44190e 100644
--- a/app/helpers/snippets_helper.rb
+++ b/app/helpers/snippets_helper.rb
@@ -13,7 +13,7 @@ module SnippetsHelper
 
   def download_raw_snippet_button(snippet)
     link_to(icon('download'),
-            raw_snippet_path(snippet, inline: false),
+            gitlab_raw_snippet_path(snippet, inline: false),
             target: '_blank',
             rel: 'noopener noreferrer',
             class: "btn btn-sm has-tooltip",
@@ -109,7 +109,7 @@ module SnippetsHelper
   end
 
   def snippet_embed_tag(snippet)
-    content_tag(:script, nil, src: snippet_url(snippet, format: :js))
+    content_tag(:script, nil, src: gitlab_snippet_url(snippet, format: :js))
   end
 
   def snippet_badge(snippet)
@@ -134,7 +134,7 @@ module SnippetsHelper
     return if blob.empty? || blob.binary? || blob.stored_externally?
 
     link_to(external_snippet_icon('doc-code'),
-            raw_snippet_url(@snippet),
+            gitlab_raw_snippet_url(@snippet),
             class: 'btn',
             target: '_blank',
             rel: 'noopener noreferrer',
@@ -143,7 +143,7 @@ module SnippetsHelper
 
   def embedded_snippet_download_button
     link_to(external_snippet_icon('download'),
-            raw_snippet_url(@snippet, inline: false),
+            gitlab_raw_snippet_url(@snippet, inline: false),
             class: 'btn',
             target: '_blank',
             title: 'Download',
diff --git a/app/mailers/emails/notes.rb b/app/mailers/emails/notes.rb
index a1c8c3455b5..de70d0073b3 100644
--- a/app/mailers/emails/notes.rb
+++ b/app/mailers/emails/notes.rb
@@ -38,7 +38,7 @@ module Emails
       setup_note_mail(note_id, recipient_id)
 
       @snippet = @note.noteable
-      @target_url = snippet_url(@note.noteable)
+      @target_url = gitlab_snippet_url(@note.noteable)
       mail_answer_note_thread(@snippet, @note, note_thread_options(recipient_id, reason))
     end
 
diff --git a/app/services/groups/transfer_service.rb b/app/services/groups/transfer_service.rb
index 24813f6ddf9..4e7875e0491 100644
--- a/app/services/groups/transfer_service.rb
+++ b/app/services/groups/transfer_service.rb
@@ -39,9 +39,15 @@ module Groups
         ensure_ownership
       end
 
+      post_update_hooks(@updated_project_ids)
+
       true
     end
 
+    # Overridden in EE
+    def post_update_hooks(updated_project_ids)
+    end
+
     def ensure_allowed_transfer
       raise_transfer_error(:group_is_already_root) if group_is_already_root?
       raise_transfer_error(:same_parent_as_current) if same_parent?
@@ -96,9 +102,16 @@ module Groups
         .where(id: descendants.select(:id))
         .update_all(visibility_level: @new_parent_group.visibility_level)
 
-      @group
+      projects_to_update = @group
         .all_projects
         .where("visibility_level > ?", @new_parent_group.visibility_level)
+
+      # Used in post_update_hooks in EE. Must use pluck (and not select)
+      # here as after we perform the update below we won't be able to find
+      # these records again.
+      @updated_project_ids = projects_to_update.pluck(:id)
+
+      projects_to_update
         .update_all(visibility_level: @new_parent_group.visibility_level)
     end
     # rubocop: enable CodeReuse/ActiveRecord
diff --git a/app/views/projects/tree/_readme.html.haml b/app/views/projects/tree/_readme.html.haml
index fef019e1b69..3e3804ae204 100644
--- a/app/views/projects/tree/_readme.html.haml
+++ b/app/views/projects/tree/_readme.html.haml
@@ -1,9 +1,10 @@
 - if readme.rich_viewer
   %article.file-holder.readme-holder{ id: 'readme', class: [("limited-width-container" unless fluid_layout), ("js-show-on-root" if vue_file_list_enabled?)] }
-    .js-file-title.file-title
-      = blob_icon readme.mode, readme.name
-      = link_to project_blob_path(@project, tree_join(@ref, readme.path)) do
-        %strong
-          = readme.name
+    .js-file-title.file-title-flex-parent
+      .file-header-content
+        = blob_icon readme.mode, readme.name
+        = link_to project_blob_path(@project, tree_join(@ref, readme.path)) do
+          %strong
+            = readme.name
 
     = render 'projects/blob/viewer', viewer: readme.rich_viewer, viewer_url: project_blob_path(@project, tree_join(@ref, readme.path), viewer: :rich, format: :json)
diff --git a/app/views/search/results/_snippet_blob.html.haml b/app/views/search/results/_snippet_blob.html.haml
index 2dbd2a74602..0b114bf67ee 100644
--- a/app/views/search/results/_snippet_blob.html.haml
+++ b/app/views/search/results/_snippet_blob.html.haml
@@ -1,7 +1,7 @@
 - snippet_blob = chunk_snippet(snippet_blob, @search_term)
 - snippet = snippet_blob[:snippet_object]
 - snippet_chunks = snippet_blob[:snippet_chunks]
-- snippet_path = snippet_path(snippet)
+- snippet_path = gitlab_snippet_path(snippet)
 
 .search-result-row
   %span
diff --git a/app/views/search/results/_snippet_title.html.haml b/app/views/search/results/_snippet_title.html.haml
index a544e59c405..81e746c55a3 100644
--- a/app/views/search/results/_snippet_title.html.haml
+++ b/app/views/search/results/_snippet_title.html.haml
@@ -1,6 +1,6 @@
 .search-result-row
   %h4.snippet-title.term
-    = link_to snippet_path(snippet_title) do
+    = link_to gitlab_snippet_path(snippet_title) do
       = truncate(snippet_title.title, length: 60)
       = snippet_badge(snippet_title)
     %span.cgray.monospace.tiny.float-right.term
diff --git a/app/views/shared/snippets/_snippet.html.haml b/app/views/shared/snippets/_snippet.html.haml
index 7d102a1b280..f38e30b0c55 100644
--- a/app/views/shared/snippets/_snippet.html.haml
+++ b/app/views/shared/snippets/_snippet.html.haml
@@ -5,7 +5,7 @@
   = image_tag avatar_icon_for_user(snippet.author), class: "avatar s40 d-none d-sm-block", alt: ''
 
   .title
-    = link_to snippet_path(snippet) do
+    = link_to gitlab_snippet_path(snippet) do
       = snippet.title
     - if snippet.file_name.present?
       %span.snippet-filename.d-none.d-sm-inline-block.ml-2
@@ -14,7 +14,7 @@
 
     %ul.controls
       %li
-        = link_to snippet_path(snippet, anchor: 'notes'), class: ('no-comments' if notes_count.zero?) do
+        = link_to gitlab_snippet_path(snippet, anchor: 'notes'), class: ('no-comments' if notes_count.zero?) do
           = icon('comments')
           = notes_count
       %li
diff --git a/app/views/snippets/_actions.html.haml b/app/views/snippets/_actions.html.haml
index a408278f7c9..5ee12a2f22a 100644
--- a/app/views/snippets/_actions.html.haml
+++ b/app/views/snippets/_actions.html.haml
@@ -5,7 +5,7 @@
     = link_to edit_snippet_path(@snippet), class: "btn btn-grouped" do
       = _("Edit")
   - if can?(current_user, :admin_personal_snippet, @snippet)
-    = link_to snippet_path(@snippet), method: :delete, data: { confirm: _("Are you sure?") }, class: "btn btn-grouped btn-inverted btn-remove", title: _('Delete Snippet') do
+    = link_to gitlab_snippet_path(@snippet), method: :delete, data: { confirm: _("Are you sure?") }, class: "btn btn-grouped btn-inverted btn-remove", title: _('Delete Snippet') do
       = _("Delete")
   - if can?(current_user, :create_personal_snippet)
     = link_to new_snippet_path, class: "btn btn-grouped btn-success btn-inverted", title: _("New snippet") do
@@ -24,7 +24,7 @@
             = _("New snippet")
       - if can?(current_user, :admin_personal_snippet, @snippet)
         %li
-          = link_to snippet_path(@snippet), method: :delete, data: { confirm: _("Are you sure?") }, title: _('Delete Snippet') do
+          = link_to gitlab_snippet_path(@snippet), method: :delete, data: { confirm: _("Are you sure?") }, title: _('Delete Snippet') do
             = _("Delete")
       - if can?(current_user, :update_personal_snippet, @snippet)
         %li
diff --git a/app/views/snippets/edit.html.haml b/app/views/snippets/edit.html.haml
index ebc6c0a2605..f5ffb037152 100644
--- a/app/views/snippets/edit.html.haml
+++ b/app/views/snippets/edit.html.haml
@@ -3,4 +3,4 @@
 %h3.page-title
   = _("Edit Snippet")
 %hr
-= render 'shared/snippets/form', url: snippet_path(@snippet)
+= render 'shared/snippets/form', url: gitlab_snippet_path(@snippet)
diff --git a/changelogs/unreleased/27025-add-border-top-in-readme.yml b/changelogs/unreleased/27025-add-border-top-in-readme.yml
new file mode 100644
index 00000000000..16948754db2
--- /dev/null
+++ b/changelogs/unreleased/27025-add-border-top-in-readme.yml
@@ -0,0 +1,5 @@
+---
+title: Fix top border of README file header in file list
+merge_request: 21314
+author:
+type: fixed
diff --git a/changelogs/unreleased/fj-fix-snippets-routes.yml b/changelogs/unreleased/fj-fix-snippets-routes.yml
new file mode 100644
index 00000000000..d1c607cc19c
--- /dev/null
+++ b/changelogs/unreleased/fj-fix-snippets-routes.yml
@@ -0,0 +1,5 @@
+---
+title: Rename snippet refactored routes
+merge_request: 21267
+author:
+type: fixed
diff --git a/changelogs/unreleased/security-400-path-traversal-rce2.yml b/changelogs/unreleased/security-400-path-traversal-rce2.yml
new file mode 100644
index 00000000000..3a77a4b932e
--- /dev/null
+++ b/changelogs/unreleased/security-400-path-traversal-rce2.yml
@@ -0,0 +1,5 @@
+---
+title: Update maven_file_name_regex for full string match
+merge_request:
+author:
+type: security
diff --git a/lib/gitlab/url_builder.rb b/lib/gitlab/url_builder.rb
index 5a9eef8288f..4bedf7a301e 100644
--- a/lib/gitlab/url_builder.rb
+++ b/lib/gitlab/url_builder.rb
@@ -25,7 +25,7 @@ module Gitlab
       when WikiPage
         wiki_page_url
       when Snippet
-        opts[:raw].present? ? raw_snippet_url(object) : snippet_url(object)
+        opts[:raw].present? ? gitlab_raw_snippet_url(object) : gitlab_snippet_url(object)
       when Milestone
         milestone_url(object)
       when ::Ci::Build
@@ -65,7 +65,7 @@ module Gitlab
         merge_request_url(object.noteable, anchor: dom_id(object))
 
       elsif object.for_snippet?
-        snippet_url(object.noteable, anchor: dom_id(object))
+        gitlab_snippet_url(object.noteable, anchor: dom_id(object))
       end
     end
 
diff --git a/qa/qa/specs/features/browser_ui/1_manage/project/import_github_repo_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/project/import_github_repo_spec.rb
index 7a47194c3a4..e0045a4d8a1 100644
--- a/qa/qa/specs/features/browser_ui/1_manage/project/import_github_repo_spec.rb
+++ b/qa/qa/specs/features/browser_ui/1_manage/project/import_github_repo_spec.rb
@@ -1,7 +1,8 @@
 # frozen_string_literal: true
 
 module QA
-  # https://gitlab.com/gitlab-org/gitlab-foss/issues/58158
+  # https://gitlab.com/gitlab-org/gitlab/issues/26952
+  # BUG_IN_CODE
   context 'Manage', :github, :quarantine do
     describe 'Project import from GitHub' do
       let(:imported_project) do
diff --git a/qa/qa/specs/features/browser_ui/3_create/merge_request/rebase_merge_request_spec.rb b/qa/qa/specs/features/browser_ui/3_create/merge_request/rebase_merge_request_spec.rb
index c41cb24f4c2..e4c79bf75b5 100644
--- a/qa/qa/specs/features/browser_ui/3_create/merge_request/rebase_merge_request_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/merge_request/rebase_merge_request_spec.rb
@@ -1,7 +1,8 @@
 # frozen_string_literal: true
 
 module QA
-  # Failure issue: https://gitlab.com/gitlab-org/quality/staging/issues/66
+  # Failure issue: https://gitlab.com/gitlab-org/gitlab/issues/36817
+  # BUG_IN_CODE
   context 'Create', :quarantine do
     describe 'Merge request rebasing' do
       it 'user rebases source branch of merge request' do
diff --git a/qa/qa/specs/features/browser_ui/3_create/repository/protocol_v2_push_http_spec.rb b/qa/qa/specs/features/browser_ui/3_create/repository/protocol_v2_push_http_spec.rb
index 3771be1a8d1..1f156dfe6d5 100644
--- a/qa/qa/specs/features/browser_ui/3_create/repository/protocol_v2_push_http_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/repository/protocol_v2_push_http_spec.rb
@@ -2,7 +2,8 @@
 
 module QA
   # Git protocol v2 is temporarily disabled
-  # https://gitlab.com/gitlab-org/gitlab-foss/issues/55769 (confidential)
+  # https://gitlab.com/gitlab-org/gitlab/issues/27828
+  # BUG_IN_CODE
   context 'Create', :quarantine do
     describe 'Push over HTTP using Git protocol version 2', :requires_git_protocol_v2 do
       it 'user pushes to the repository' do
diff --git a/qa/qa/specs/features/browser_ui/3_create/repository/protocol_v2_push_ssh_spec.rb b/qa/qa/specs/features/browser_ui/3_create/repository/protocol_v2_push_ssh_spec.rb
index e2b2ee801c3..55c70656462 100644
--- a/qa/qa/specs/features/browser_ui/3_create/repository/protocol_v2_push_ssh_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/repository/protocol_v2_push_ssh_spec.rb
@@ -2,7 +2,8 @@
 
 module QA
   # Git protocol v2 is temporarily disabled
-  # https://gitlab.com/gitlab-org/gitlab-foss/issues/55769 (confidential)
+  # https://gitlab.com/gitlab-org/gitlab/issues/27828
+  # BUG_IN_CODE
   context 'Create', :quarantine do
     describe 'Push over SSH using Git protocol version 2', :requires_git_protocol_v2 do
       # Note: If you run this test against GDK make sure you've enabled sshd and
diff --git a/scripts/security-harness b/scripts/security-harness
index 8369cf06223..a1642489fe2 100755
--- a/scripts/security-harness
+++ b/scripts/security-harness
@@ -1,57 +1,99 @@
 #!/usr/bin/env ruby
 
+# frozen_string_literal: true
+
 require 'digest'
 require 'fileutils'
 
-harness_path = File.expand_path('../.git/security_harness', __dir__)
-hook_path    = File.expand_path("../.git/hooks/pre-push", __dir__)
+if ENV['NO_COLOR']
+  SHELL_RED    = ''
+  SHELL_GREEN  = ''
+  SHELL_YELLOW = ''
+  SHELL_CLEAR  = ''
+else
+  SHELL_RED    = "\e[1;31m"
+  SHELL_GREEN  = "\e[1;32m"
+  SHELL_YELLOW = "\e[1;33m"
+  SHELL_CLEAR  = "\e[0m"
+end
 
-if File.exist?(hook_path)
-  # Deal with a pre-existing hook
-  source_sum = Digest::SHA256.hexdigest(DATA.read)
-  dest_sum   = Digest::SHA256.file(hook_path).hexdigest
+HOOK_PATH = File.expand_path("../.git/hooks/pre-push", __dir__)
+HOOK_DATA = <<~HOOK
+  #!/bin/bash
 
-  if source_sum != dest_sum
-    puts "#{hook_path} exists and is different from our hook!"
-    puts "Remove it and re-run this script to continue."
+  set -e
 
-    exit 1
-  end
-else
-  File.open(hook_path, 'w') do |file|
-    IO.copy_stream(DATA, file)
-  end
+  url="$2"
+  harness=`dirname "$0"`/../security_harness
+
+  if [ -e "$harness" ]
+  then
+    if [[ ("$url" != *"dev.gitlab.org"*) && ("$url" != *"gitlab-org/security/"*) ]]
+    then
+      echo "Pushing to remotes other than dev.gitlab.org and gitlab.com/gitlab-org/security has been disabled!"
+      echo "Run scripts/security-harness to disable this check."
+      echo
+
+      exit 1
+    fi
+  fi
+HOOK
 
-  File.chmod(0755, hook_path)
+def write_hook
+  FileUtils.mkdir_p(File.dirname(HOOK_PATH))
+  File.open(HOOK_PATH, 'w') do |file|
+    file.write(HOOK_DATA)
+  end
+  File.chmod(0755, HOOK_PATH)
 end
 
 # Toggle the harness on or off
-if File.exist?(harness_path)
-  FileUtils.rm(harness_path)
+def toggle
+  harness_path = File.expand_path('../.git/security_harness', __dir__)
 
-  puts "Security harness removed -- you can now push to all remotes."
-else
-  FileUtils.touch(harness_path)
+  if File.exist?(harness_path)
+    FileUtils.rm(harness_path)
 
-  puts "Security harness installed -- you will only be able to push to dev.gitlab.org!"
-end
+    puts "#{SHELL_YELLOW}Security harness removed -- you can now push to all remotes.#{SHELL_CLEAR}"
+  else
+    FileUtils.touch(harness_path)
 
-__END__
-#!/bin/bash
+    puts "#{SHELL_GREEN}Security harness installed -- you will only be able to push to dev.gitlab.org or gitlab.com/gitlab-org/security!#{SHELL_CLEAR}"
+  end
+end
 
-set -e
+# If we were to change the script and then check for a pre-existing hook before
+# writing, the check would fail even if the user had an unmodified version of
+# the old hook. Checking previous version hashes allows us to safely overwrite a
+# script that differs from the current version, as long as it's an old one and
+# not custom.
+def previous_version?(dest_sum)
+  # SHA256 hashes of previous iterations of the script contained in `DATA`
+  %w[
+    010bf0363a911ebab2bd5728d80795ed02388da51815f0b2530d08ae8ac574f0
+  ].include?(dest_sum)
+end
 
-url="$2"
-harness=`dirname "$0"`/../security_harness
+if !File.exist?(HOOK_PATH)
+  write_hook
+  toggle
+else
+  # Deal with a pre-existing hook
+  source_sum = Digest::SHA256.hexdigest(HOOK_DATA)
+  dest_sum   = Digest::SHA256.file(HOOK_PATH).hexdigest
 
-if [ -e "$harness" ]
-then
-  if [[ "$url" != *"dev.gitlab.org"* ]]
-  then
-    echo "Pushing to remotes other than dev.gitlab.org has been disabled!"
-    echo "Run scripts/security-harness to disable this check."
-    echo
+  if previous_version?(dest_sum)
+    # Upgrading from a previous version, update in-place
+    write_hook
+    toggle
+  elsif source_sum != dest_sum
+    # Pre-existing hook we didn't create; do nothing
+    puts "#{SHELL_RED}#{HOOK_PATH} exists and is different from our hook!"
+    puts "Remove it and re-run this script to continue.#{SHELL_CLEAR}"
 
     exit 1
-  fi
-fi
+  else
+    # No hook update needed, just toggle
+    toggle
+  end
+end
diff --git a/spec/features/projects/snippets/user_views_snippets_spec.rb b/spec/features/projects/snippets/user_views_snippets_spec.rb
index 59869244b4a..5739c9510a8 100644
--- a/spec/features/projects/snippets/user_views_snippets_spec.rb
+++ b/spec/features/projects/snippets/user_views_snippets_spec.rb
@@ -28,7 +28,7 @@ describe 'Projects > Snippets > User views snippets' do
   end
 
   it 'shows snippets' do
-    expect(page).to have_content(project_snippet.title)
+    expect(page).to have_link(project_snippet.title, href: project_snippet_path(project, project_snippet))
     expect(page).not_to have_content(snippet.title)
   end
 end
diff --git a/spec/features/snippets/user_snippets_spec.rb b/spec/features/snippets/user_snippets_spec.rb
index c6daa19d5e6..d9faea55b29 100644
--- a/spec/features/snippets/user_snippets_spec.rb
+++ b/spec/features/snippets/user_snippets_spec.rb
@@ -14,9 +14,9 @@ describe 'User Snippets' do
   end
 
   it 'View all of my snippets' do
-    expect(page).to have_content(public_snippet.title)
-    expect(page).to have_content(internal_snippet.title)
-    expect(page).to have_content(private_snippet.title)
+    expect(page).to have_link(public_snippet.title, href: snippet_path(public_snippet))
+    expect(page).to have_link(internal_snippet.title, href: snippet_path(internal_snippet))
+    expect(page).to have_link(private_snippet.title, href: snippet_path(private_snippet))
   end
 
   it 'View my public snippets' do
diff --git a/spec/helpers/gitlab_routing_helper_spec.rb b/spec/helpers/gitlab_routing_helper_spec.rb
index 9cc1a9dfd5b..e76ebcb5637 100644
--- a/spec/helpers/gitlab_routing_helper_spec.rb
+++ b/spec/helpers/gitlab_routing_helper_spec.rb
@@ -118,91 +118,91 @@ describe GitlabRoutingHelper do
     let_it_be(:project_snippet) { create(:project_snippet) }
     let_it_be(:note) { create(:note_on_personal_snippet, noteable: personal_snippet) }
 
-    describe '#snippet_path' do
+    describe '#gitlab_snippet_path' do
       it 'returns the personal snippet path' do
-        expect(snippet_path(personal_snippet)).to eq("/snippets/#{personal_snippet.id}")
+        expect(gitlab_snippet_path(personal_snippet)).to eq("/snippets/#{personal_snippet.id}")
       end
 
       it 'returns the project snippet path' do
-        expect(snippet_path(project_snippet)).to eq("/#{project_snippet.project.full_path}/snippets/#{project_snippet.id}")
+        expect(gitlab_snippet_path(project_snippet)).to eq("/#{project_snippet.project.full_path}/snippets/#{project_snippet.id}")
       end
     end
 
-    describe '#snippet_url' do
+    describe '#gitlab_snippet_url' do
       it 'returns the personal snippet url' do
-        expect(snippet_url(personal_snippet)).to eq("#{Settings.gitlab['url']}/snippets/#{personal_snippet.id}")
+        expect(gitlab_snippet_url(personal_snippet)).to eq("http://test.host/snippets/#{personal_snippet.id}")
       end
 
       it 'returns the project snippet url' do
-        expect(snippet_url(project_snippet)).to eq("#{Settings.gitlab['url']}/#{project_snippet.project.full_path}/snippets/#{project_snippet.id}")
+        expect(gitlab_snippet_url(project_snippet)).to eq("http://test.host/#{project_snippet.project.full_path}/snippets/#{project_snippet.id}")
       end
     end
 
-    describe '#raw_snippet_path' do
+    describe '#gitlab_raw_snippet_path' do
       it 'returns the raw personal snippet path' do
-        expect(raw_snippet_path(personal_snippet)).to eq("/snippets/#{personal_snippet.id}/raw")
+        expect(gitlab_raw_snippet_path(personal_snippet)).to eq("/snippets/#{personal_snippet.id}/raw")
       end
 
       it 'returns the raw project snippet path' do
-        expect(raw_snippet_path(project_snippet)).to eq("/#{project_snippet.project.full_path}/snippets/#{project_snippet.id}/raw")
+        expect(gitlab_raw_snippet_path(project_snippet)).to eq("/#{project_snippet.project.full_path}/snippets/#{project_snippet.id}/raw")
       end
     end
 
-    describe '#raw_snippet_url' do
+    describe '#gitlab_raw_snippet_url' do
       it 'returns the raw personal snippet url' do
-        expect(raw_snippet_url(personal_snippet)).to eq("#{Settings.gitlab['url']}/snippets/#{personal_snippet.id}/raw")
+        expect(gitlab_raw_snippet_url(personal_snippet)).to eq("http://test.host/snippets/#{personal_snippet.id}/raw")
       end
 
       it 'returns the raw project snippet url' do
-        expect(raw_snippet_url(project_snippet)).to eq("#{Settings.gitlab['url']}/#{project_snippet.project.full_path}/snippets/#{project_snippet.id}/raw")
+        expect(gitlab_raw_snippet_url(project_snippet)).to eq("http://test.host/#{project_snippet.project.full_path}/snippets/#{project_snippet.id}/raw")
       end
     end
 
-    describe '#snippet_notes_path' do
+    describe '#gitlab_snippet_notes_path' do
       it 'returns the notes path for the personal snippet' do
-        expect(snippet_notes_path(personal_snippet)).to eq("/snippets/#{personal_snippet.id}/notes")
+        expect(gitlab_snippet_notes_path(personal_snippet)).to eq("/snippets/#{personal_snippet.id}/notes")
       end
     end
 
-    describe '#snippet_notes_url' do
+    describe '#gitlab_snippet_notes_url' do
       it 'returns the notes url for the personal snippet' do
-        expect(snippet_notes_url(personal_snippet)).to eq("#{Settings.gitlab['url']}/snippets/#{personal_snippet.id}/notes")
+        expect(gitlab_snippet_notes_url(personal_snippet)).to eq("http://test.host/snippets/#{personal_snippet.id}/notes")
       end
     end
 
-    describe '#snippet_note_path' do
+    describe '#gitlab_snippet_note_path' do
       it 'returns the note path for the personal snippet' do
-        expect(snippet_note_path(personal_snippet, note)).to eq("/snippets/#{personal_snippet.id}/notes/#{note.id}")
+        expect(gitlab_snippet_note_path(personal_snippet, note)).to eq("/snippets/#{personal_snippet.id}/notes/#{note.id}")
       end
     end
 
-    describe '#snippet_note_url' do
+    describe '#gitlab_snippet_note_url' do
       it 'returns the note url for the personal snippet' do
-        expect(snippet_note_url(personal_snippet, note)).to eq("#{Settings.gitlab['url']}/snippets/#{personal_snippet.id}/notes/#{note.id}")
+        expect(gitlab_snippet_note_url(personal_snippet, note)).to eq("http://test.host/snippets/#{personal_snippet.id}/notes/#{note.id}")
       end
     end
 
-    describe '#toggle_award_emoji_snippet_note_path' do
+    describe '#gitlab_toggle_award_emoji_snippet_note_path' do
       it 'returns the note award emoji path for the personal snippet' do
-        expect(toggle_award_emoji_snippet_note_path(personal_snippet, note)).to eq("/snippets/#{personal_snippet.id}/notes/#{note.id}/toggle_award_emoji")
+        expect(gitlab_toggle_award_emoji_snippet_note_path(personal_snippet, note)).to eq("/snippets/#{personal_snippet.id}/notes/#{note.id}/toggle_award_emoji")
       end
     end
 
-    describe '#toggle_award_emoji_snippet_note_url' do
+    describe '#gitlab_toggle_award_emoji_snippet_note_url' do
       it 'returns the note award emoji url for the personal snippet' do
-        expect(toggle_award_emoji_snippet_note_url(personal_snippet, note)).to eq("#{Settings.gitlab['url']}/snippets/#{personal_snippet.id}/notes/#{note.id}/toggle_award_emoji")
+        expect(gitlab_toggle_award_emoji_snippet_note_url(personal_snippet, note)).to eq("http://test.host/snippets/#{personal_snippet.id}/notes/#{note.id}/toggle_award_emoji")
       end
     end
 
-    describe '#toggle_award_emoji_snippet_path' do
+    describe '#gitlab_toggle_award_emoji_snippet_path' do
       it 'returns the award emoji path for the personal snippet' do
-        expect(toggle_award_emoji_snippet_path(personal_snippet)).to eq("/snippets/#{personal_snippet.id}/toggle_award_emoji")
+        expect(gitlab_toggle_award_emoji_snippet_path(personal_snippet)).to eq("/snippets/#{personal_snippet.id}/toggle_award_emoji")
       end
     end
 
-    describe '#toggle_award_emoji_snippet_url' do
+    describe '#gitlab_toggle_award_emoji_snippet_url' do
       it 'returns the award url for the personal snippet' do
-        expect(toggle_award_emoji_snippet_url(personal_snippet)).to eq("#{Settings.gitlab['url']}/snippets/#{personal_snippet.id}/toggle_award_emoji")
+        expect(gitlab_toggle_award_emoji_snippet_url(personal_snippet)).to eq("http://test.host/snippets/#{personal_snippet.id}/toggle_award_emoji")
       end
     end
   end
diff --git a/spec/helpers/issuables_helper_spec.rb b/spec/helpers/issuables_helper_spec.rb
index 1af8b7390bb..57ea5416989 100644
--- a/spec/helpers/issuables_helper_spec.rb
+++ b/spec/helpers/issuables_helper_spec.rb
@@ -202,6 +202,26 @@ describe IssuablesHelper do
       expect(helper.issuable_initial_data(issue)).to match(hash_including(expected_data))
     end
 
+    describe '#sentryIssueIdentifier' do
+      let(:issue) { create(:issue, author: user) }
+
+      before do
+        assign(:project, issue.project)
+      end
+
+      it 'sets sentryIssueIdentifier to nil with no sentry issue ' do
+        expect(helper.issuable_initial_data(issue)[:sentryIssueIdentifier])
+          .to be_nil
+      end
+
+      it 'sets sentryIssueIdentifier to sentry_issue_identifier' do
+        sentry_issue = create(:sentry_issue, issue: issue)
+
+        expect(helper.issuable_initial_data(issue)[:sentryIssueIdentifier])
+          .to eq(sentry_issue.sentry_issue_identifier)
+      end
+    end
+
     describe '#zoomMeetingUrl in issue' do
       let(:issue) { create(:issue, author: user) }
 
diff --git a/spec/helpers/snippets_helper_spec.rb b/spec/helpers/snippets_helper_spec.rb
index 2a24950502b..428fe97f172 100644
--- a/spec/helpers/snippets_helper_spec.rb
+++ b/spec/helpers/snippets_helper_spec.rb
@@ -14,13 +14,13 @@ describe SnippetsHelper do
 
     it 'returns view raw button of embedded snippets for personal snippets' do
       @snippet = create(:personal_snippet, :public)
-      expect(subject).to eq(download_link("#{Settings.gitlab['url']}/snippets/#{@snippet.id}/raw"))
+      expect(subject).to eq(download_link("http://test.host/snippets/#{@snippet.id}/raw"))
     end
 
     it 'returns view raw button of embedded snippets for project snippets' do
       @snippet = create(:project_snippet, :public)
 
-      expect(subject).to eq(download_link("#{Settings.gitlab['url']}/#{@snippet.project.path_with_namespace}/snippets/#{@snippet.id}/raw"))
+      expect(subject).to eq(download_link("http://test.host/#{@snippet.project.path_with_namespace}/snippets/#{@snippet.id}/raw"))
     end
 
     def download_link(url)
@@ -34,13 +34,13 @@ describe SnippetsHelper do
     it 'returns download button of embedded snippets for personal snippets' do
       @snippet = create(:personal_snippet, :public)
 
-      expect(subject).to eq(download_link("#{Settings.gitlab['url']}/snippets/#{@snippet.id}/raw"))
+      expect(subject).to eq(download_link("http://test.host/snippets/#{@snippet.id}/raw"))
     end
 
     it 'returns download button of embedded snippets for project snippets' do
       @snippet = create(:project_snippet, :public)
 
-      expect(subject).to eq(download_link("#{Settings.gitlab['url']}/#{@snippet.project.path_with_namespace}/snippets/#{@snippet.id}/raw"))
+      expect(subject).to eq(download_link("http://test.host/#{@snippet.project.path_with_namespace}/snippets/#{@snippet.id}/raw"))
     end
 
     def download_link(url)
@@ -56,7 +56,7 @@ describe SnippetsHelper do
 
       context 'public' do
         it 'returns a script tag with the snippet full url' do
-          expect(subject).to eq(script_embed("#{Settings.gitlab['url']}/snippets/#{snippet.id}"))
+          expect(subject).to eq(script_embed("http://test.host/snippets/#{snippet.id}"))
         end
       end
     end
@@ -65,7 +65,7 @@ describe SnippetsHelper do
       let(:snippet) { public_project_snippet }
 
       it 'returns a script tag with the snippet full url' do
-        expect(subject).to eq(script_embed("#{Settings.gitlab['url']}/#{snippet.project.path_with_namespace}/snippets/#{snippet.id}"))
+        expect(subject).to eq(script_embed("http://test.host/#{snippet.project.path_with_namespace}/snippets/#{snippet.id}"))
       end
     end