Merge remote-tracking branch 'upstream/master' into 27762-add-default-artifacts-expiration

* upstream/master: (37 commits)
  Show merge errors in merge request widget
  Clarify that stage is needed to stop environments
  Fix broken link in university docs
  allow clicking on text or icon to trigger expand
  style links on system notes to look clickable
  Clean up terms used for issues. Use New instead of Add.
  Fix most of broken docs links
  Set `Auto-Submitted: auto-generated` header to emails
  Fix Rubocop offense
  Fix regression where cmd-click stopped working for todos and merge request tabs
  Remove changelog entries for 8.16.5 release
  Merge branch 'fix-github-import-MR-wrong-project' into 'security'
  Merge branch 'svg-xss-fix' into 'security'
  Merge branch 'fix-rdoc-xss' into 'security'
  Merge branch 'asciidoctor-xss-patch' into 'security'
  Specify that only project owners can transfer a project
  only load istanbul plugin in development mode
  Make Karma output look nicer for CI (!9165)
  Centers loading icon vertically and horizontally in pipelines table in commit view
  Rename builds to jobs in docs
  ...

12 files changed, 51 insertions, 30 deletions

diff --git a/lib/additional_email_headers_interceptor.rb b/lib/additional_email_headers_interceptor.rb
new file mode 100644
index 00000000000..2358fa6bbfd
--- /dev/null
+++ b/lib/additional_email_headers_interceptor.rb
@@ -0,0 +1,8 @@
+class AdditionalEmailHeadersInterceptor
+  def self.delivering_email(message)
+    message.headers(
+      'Auto-Submitted' => 'auto-generated',
+      'X-Auto-Response-Suppress' => 'All'
+    )
+  end
+end
diff --git a/lib/api/commit_statuses.rb b/lib/api/commit_statuses.rb
index b6e6820c3f4..0b6076bd28c 100644
--- a/lib/api/commit_statuses.rb
+++ b/lib/api/commit_statuses.rb
@@ -46,6 +46,7 @@ module API
         optional :description, type: String,  desc: 'A short description of the status'
         optional :name,        type: String,  desc: 'A string label to differentiate this status from the status of other systems. Default: "default"'
         optional :context,     type: String,  desc: 'A string label to differentiate this status from the status of other systems. Default: "default"'
+        optional :coverage,    type: Float,   desc: 'The total code coverage'
       end
       post ':id/statuses/:sha' do
         authorize! :create_commit_status, user_project
@@ -75,7 +76,8 @@ module API
           name: name,
           ref: ref,
           target_url: params[:target_url],
-          description: params[:description]
+          description: params[:description],
+          coverage: params[:coverage]
         )
 
         render_validation_error!(status) if status.invalid?
diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index fb0584539db..94f5bd510c9 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -155,10 +155,27 @@ module API
       expose :shared_projects, using: Entities::Project
     end
 
+    class RepoCommit < Grape::Entity
+      expose :id, :short_id, :title, :created_at
+      expose :parent_ids
+      expose :safe_message, as: :message
+      expose :author_name, :author_email, :authored_date
+      expose :committer_name, :committer_email, :committed_date
+    end
+
+    class RepoCommitStats < Grape::Entity
+      expose :additions, :deletions, :total
+    end
+
+    class RepoCommitDetail < RepoCommit
+      expose :stats, using: Entities::RepoCommitStats
+      expose :status
+    end
+
     class RepoBranch < Grape::Entity
       expose :name
 
-      expose :commit do |repo_branch, options|
+      expose :commit, using: Entities::RepoCommit do |repo_branch, options|
         options[:project].repository.commit(repo_branch.dereferenced_target)
       end
 
@@ -193,22 +210,6 @@ module API
       end
     end
 
-    class RepoCommit < Grape::Entity
-      expose :id, :short_id, :title, :author_name, :author_email, :created_at
-      expose :committer_name, :committer_email
-      expose :safe_message, as: :message
-    end
-
-    class RepoCommitStats < Grape::Entity
-      expose :additions, :deletions, :total
-    end
-
-    class RepoCommitDetail < RepoCommit
-      expose :parent_ids, :committed_date, :authored_date
-      expose :stats, using: Entities::RepoCommitStats
-      expose :status
-    end
-
     class ProjectSnippet < Grape::Entity
       expose :id, :title, :file_name
       expose :author, using: Entities::UserBasic
@@ -367,7 +368,7 @@ module API
 
     class CommitStatus < Grape::Entity
       expose :id, :sha, :ref, :status, :name, :target_url, :description,
-             :created_at, :started_at, :finished_at, :allow_failure
+             :created_at, :started_at, :finished_at, :allow_failure, :coverage
       expose :author, using: Entities::UserBasic
     end
 
@@ -414,7 +415,7 @@ module API
     end
 
     class Namespace < Grape::Entity
-      expose :id, :name, :path, :kind
+      expose :id, :name, :path, :kind, :full_path
     end
 
     class MemberAccess < Grape::Entity
diff --git a/lib/api/tags.rb b/lib/api/tags.rb
index 5b345db3a41..b6fd8f569a9 100644
--- a/lib/api/tags.rb
+++ b/lib/api/tags.rb
@@ -40,7 +40,7 @@ module API
       post ':id/repository/tags' do
         authorize_push_project
 
-        result = CreateTagService.new(user_project, current_user).
+        result = ::Tags::CreateService.new(user_project, current_user).
           execute(params[:tag_name], params[:ref], params[:message], params[:release_description])
 
         if result[:status] == :success
@@ -59,7 +59,7 @@ module API
       delete ":id/repository/tags/:tag_name", requirements: { tag_name: /.+/ } do
         authorize_push_project
 
-        result = DeleteTagService.new(user_project, current_user).
+        result = ::Tags::DestroyService.new(user_project, current_user).
           execute(params[:tag_name])
 
         if result[:status] == :success
diff --git a/lib/backup/repository.rb b/lib/backup/repository.rb
index d746070913d..91e43dcb114 100644
--- a/lib/backup/repository.rb
+++ b/lib/backup/repository.rb
@@ -12,7 +12,7 @@ module Backup
         path_to_project_bundle = path_to_bundle(project)
 
         # Create namespace dir if missing
-        FileUtils.mkdir_p(File.join(backup_repos_path, project.namespace.path)) if project.namespace
+        FileUtils.mkdir_p(File.join(backup_repos_path, project.namespace.full_path)) if project.namespace
 
         if project.empty_repo?
           $progress.puts "[SKIPPED]".color(:cyan)
diff --git a/lib/gitlab/asciidoc.rb b/lib/gitlab/asciidoc.rb
index 0618107e2c3..d575367d81a 100644
--- a/lib/gitlab/asciidoc.rb
+++ b/lib/gitlab/asciidoc.rb
@@ -36,6 +36,9 @@ module Gitlab
 
       html = Banzai.post_process(html, context)
 
+      filter = Banzai::Filter::SanitizationFilter.new(html)
+      html = filter.call.to_s
+
       html.html_safe
     end
 
diff --git a/lib/gitlab/github_import/importer.rb b/lib/gitlab/github_import/importer.rb
index ec1318ab33c..9a4ffd28438 100644
--- a/lib/gitlab/github_import/importer.rb
+++ b/lib/gitlab/github_import/importer.rb
@@ -115,7 +115,7 @@ module Gitlab
             begin
               issuable =
                 if gh_issue.pull_request?
-                  MergeRequest.find_by_iid(gh_issue.number)
+                  MergeRequest.find_by(target_project_id: project.id, iid: gh_issue.number)
                 else
                   gh_issue.create!
                 end
@@ -212,8 +212,12 @@ module Gitlab
               comment         = CommentFormatter.new(project, raw)
               # GH does not return info about comment's parent, so we guess it by checking its URL!
               *_, parent, iid = URI(raw.html_url).path.split('/')
-              issuable_class = parent == 'issues' ? Issue : MergeRequest
-              issuable       = issuable_class.find_by_iid(iid)
+              if parent == 'issues'
+                issuable = Issue.find_by(project_id: project.id, iid: iid)
+              else
+                issuable = MergeRequest.find_by(target_project_id: project.id, iid: iid)
+              end
+
               next unless issuable
 
               issuable.notes.create!(comment.attributes)
diff --git a/lib/gitlab/google_code_import/importer.rb b/lib/gitlab/google_code_import/importer.rb
index 1f4edc36928..b02b9737493 100644
--- a/lib/gitlab/google_code_import/importer.rb
+++ b/lib/gitlab/google_code_import/importer.rb
@@ -310,7 +310,7 @@ module Gitlab
           if name == project.import_source
             "##{id}"
           else
-            "#{project.namespace.path}/#{name}##{id}"
+            "#{project.namespace.full_path}/#{name}##{id}"
           end
         text = "~~#{text}~~" if deleted
         text
diff --git a/lib/gitlab/import_export.rb b/lib/gitlab/import_export.rb
index d679edec36b..a46a41bc56e 100644
--- a/lib/gitlab/import_export.rb
+++ b/lib/gitlab/import_export.rb
@@ -35,7 +35,7 @@ module Gitlab
     end
 
     def export_filename(project:)
-      basename = "#{Time.now.strftime('%Y-%m-%d_%H-%M-%3N')}_#{project.namespace.path}_#{project.path}"
+      basename = "#{Time.now.strftime('%Y-%m-%d_%H-%M-%3N')}_#{project.namespace.full_path}_#{project.path}"
 
       "#{basename[0..FILENAME_LIMIT]}_export.tar.gz"
     end
diff --git a/lib/gitlab/import_export/importer.rb b/lib/gitlab/import_export/importer.rb
index e9ee47fc090..063ce74ecad 100644
--- a/lib/gitlab/import_export/importer.rb
+++ b/lib/gitlab/import_export/importer.rb
@@ -56,7 +56,7 @@ module Gitlab
       end
 
       def path_with_namespace
-        File.join(@project.namespace.path, @project.path)
+        File.join(@project.namespace.full_path, @project.path)
       end
 
       def repo_path
diff --git a/lib/gitlab/other_markup.rb b/lib/gitlab/other_markup.rb
index 4e2f8ed5587..e67acf28c94 100644
--- a/lib/gitlab/other_markup.rb
+++ b/lib/gitlab/other_markup.rb
@@ -17,6 +17,9 @@ module Gitlab
 
       html = Banzai.post_process(html, context)
 
+      filter = Banzai::Filter::SanitizationFilter.new(html)
+      html = filter.call.to_s
+
       html.html_safe
     end
   end
diff --git a/lib/gitlab/shell.rb b/lib/gitlab/shell.rb
index 82e194c1af1..942cedd6cd4 100644
--- a/lib/gitlab/shell.rb
+++ b/lib/gitlab/shell.rb
@@ -172,7 +172,7 @@ module Gitlab
     #   add_namespace("/path/to/storage", "gitlab")
     #
     def add_namespace(storage, name)
-      FileUtils.mkdir(full_path(storage, name), mode: 0770) unless exists?(storage, name)
+      FileUtils.mkdir_p(full_path(storage, name), mode: 0770) unless exists?(storage, name)
     end
 
     # Remove directory from repositories storage