Merge branch 'master' into feature/multi-level-container-registry-images

* master: (1327 commits)
  Merge branch 'render-json-leak' into 'security'
  Merge branch 'ssrf' into 'security'
  Merge branch 'ssrf' into 'security'
  Merge branch 'fix-links-target-blank' into 'security'
  Merge branch '28058-hide-emails-in-atom-feeds' into 'security'
  Fix karma test
  Reset filters after click
  Handle Route#name being nil after an update
  Only add frontend code coverage instrumentation when generating coverage report
  fix recompile assets step in 9.0 upgrade guide to use yarn
  Undo explicit conversion to Integer
  Make level_value accept string integers
  Make feature spec more robust
  Removed d3.js from the main application.js bundle
  Extend compound status for manual actions specs
  Update css to be nice and tidy.
  Fix pipeline status for transition between stages
  add an index to the ghost column
  Return 404 in project issues API endpoint when project cannot be found
  Improve rename projects migration
  ...

Conflicts:
	doc/ci/docker/using_docker_build.md
	spec/lib/gitlab/import_export/all_models.yml

1 files changed, 76 insertions, 54 deletions

diff --git a/spec/controllers/projects/merge_requests_controller_spec.rb b/spec/controllers/projects/merge_requests_controller_spec.rb
index f84f922ba5e..c310d830e81 100644
--- a/spec/controllers/projects/merge_requests_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests_controller_spec.rb
@@ -43,7 +43,8 @@ describe Projects::MergeRequestsController do
           submit_new_merge_request(format: :json)
 
           expect(response).to be_ok
-          expect(json_response).not_to be_empty
+          expect(json_response).to have_key 'pipelines'
+          expect(json_response['pipelines']).not_to be_empty
         end
       end
     end
@@ -51,10 +52,11 @@ describe Projects::MergeRequestsController do
     def submit_new_merge_request(format: :html)
       get :new,
           namespace_id: fork_project.namespace.to_param,
-          project_id: fork_project.to_param,
+          project_id: fork_project,
           merge_request: {
             source_branch: 'remove-submodule',
-            target_branch: 'master' },
+            target_branch: 'master'
+          },
           format: format
     end
   end
@@ -63,7 +65,7 @@ describe Projects::MergeRequestsController do
     it "loads labels into the @labels variable" do
       get action,
           namespace_id: project.namespace.to_param,
-          project_id: project.to_param,
+          project_id: project,
           id: merge_request.iid,
           format: 'html'
       expect(assigns(:labels)).not_to be_nil
@@ -75,7 +77,7 @@ describe Projects::MergeRequestsController do
       it "does generally work" do
         get(:show,
             namespace_id: project.namespace.to_param,
-            project_id: project.to_param,
+            project_id: project,
             id: merge_request.iid,
             format: format)
 
@@ -89,7 +91,7 @@ describe Projects::MergeRequestsController do
 
         get(:show,
             namespace_id: project.namespace.to_param,
-            project_id: project.to_param,
+            project_id: project,
             id: merge_request.iid,
             format: format)
       end
@@ -97,7 +99,7 @@ describe Projects::MergeRequestsController do
       it "renders it" do
         get(:show,
             namespace_id: project.namespace.to_param,
-            project_id: project.to_param,
+            project_id: project,
             id: merge_request.iid,
             format: format)
 
@@ -110,7 +112,7 @@ describe Projects::MergeRequestsController do
 
         get(:show,
             namespace_id: project.namespace.to_param,
-            project_id: project.to_param,
+            project_id: project,
             id: merge_request.iid,
             format: format)
 
@@ -125,7 +127,7 @@ describe Projects::MergeRequestsController do
       it "triggers workhorse to serve the request" do
         get(:show,
             namespace_id: project.namespace.to_param,
-            project_id: project.to_param,
+            project_id: project,
             id: merge_request.iid,
             format: :diff)
 
@@ -137,7 +139,7 @@ describe Projects::MergeRequestsController do
       it 'triggers workhorse to serve the request' do
         get(:show,
             namespace_id: project.namespace.to_param,
-            project_id: project.to_param,
+            project_id: project,
             id: merge_request.iid,
             format: :patch)
 
@@ -152,7 +154,7 @@ describe Projects::MergeRequestsController do
     def get_merge_requests(page = nil)
       get :index,
           namespace_id: project.namespace.to_param,
-          project_id: project.to_param,
+          project_id: project,
           state: 'opened', page: page.to_param
     end
 
@@ -201,6 +203,24 @@ describe Projects::MergeRequestsController do
   end
 
   describe 'PUT update' do
+    context 'changing the assignee' do
+      it 'limits the attributes exposed on the assignee' do
+        assignee = create(:user)
+        project.add_developer(assignee)
+
+        put :update,
+          namespace_id: project.namespace.to_param,
+          project_id: project,
+          id: merge_request.iid,
+          merge_request: { assignee_id: assignee.id },
+          format: :json
+        body = JSON.parse(response.body)
+
+        expect(body['assignee'].keys)
+          .to match_array(%w(name username avatar_url))
+      end
+    end
+
     context 'there is no source project' do
       let(:project)       { create(:project) }
       let(:fork_project)  { create(:forked_project_with_submodules) }
@@ -215,8 +235,8 @@ describe Projects::MergeRequestsController do
 
       it 'closes MR without errors' do
         post :update,
-            namespace_id: project.namespace.path,
-            project_id: project.path,
+            namespace_id: project.namespace,
+            project_id: project,
             id: merge_request.iid,
             merge_request: {
               state_event: 'close'
@@ -230,8 +250,8 @@ describe Projects::MergeRequestsController do
         merge_request.close!
 
         put :update,
-            namespace_id: project.namespace.path,
-            project_id: project.path,
+            namespace_id: project.namespace,
+            project_id: project,
             id: merge_request.iid,
             merge_request: {
               title: 'New title'
@@ -245,8 +265,8 @@ describe Projects::MergeRequestsController do
         merge_request.close!
 
         put :update,
-            namespace_id: project.namespace.path,
-            project_id: project.path,
+            namespace_id: project.namespace,
+            project_id: project,
             id: merge_request.iid,
             merge_request: {
               target_branch: 'new_branch'
@@ -254,14 +274,16 @@ describe Projects::MergeRequestsController do
 
         expect { merge_request.reload.target_branch }.not_to change { merge_request.target_branch }
       end
+
+      it_behaves_like 'update invalid issuable', MergeRequest
     end
   end
 
   describe 'POST merge' do
     let(:base_params) do
       {
-        namespace_id: project.namespace.path,
-        project_id: project.path,
+        namespace_id: project.namespace,
+        project_id: project,
         id: merge_request.iid,
         format: 'raw'
       }
@@ -316,41 +338,41 @@ describe Projects::MergeRequestsController do
         merge_with_sha
       end
 
-      context 'when merge_when_build_succeeds is passed' do
-        def merge_when_build_succeeds
-          post :merge, base_params.merge(sha: merge_request.diff_head_sha, merge_when_build_succeeds: '1')
+      context 'when the pipeline succeeds is passed' do
+        def merge_when_pipeline_succeeds
+          post :merge, base_params.merge(sha: merge_request.diff_head_sha, merge_when_pipeline_succeeds: '1')
         end
 
         before do
           create(:ci_empty_pipeline, project: project, sha: merge_request.diff_head_sha, ref: merge_request.source_branch)
         end
 
-        it 'returns :merge_when_build_succeeds' do
-          merge_when_build_succeeds
+        it 'returns :merge_when_pipeline_succeeds' do
+          merge_when_pipeline_succeeds
 
-          expect(assigns(:status)).to eq(:merge_when_build_succeeds)
+          expect(assigns(:status)).to eq(:merge_when_pipeline_succeeds)
         end
 
-        it 'sets the MR to merge when the build succeeds' do
-          service = double(:merge_when_build_succeeds_service)
+        it 'sets the MR to merge when the pipeline succeeds' do
+          service = double(:merge_when_pipeline_succeeds_service)
 
           expect(MergeRequests::MergeWhenPipelineSucceedsService)
             .to receive(:new).with(project, anything, anything)
             .and_return(service)
           expect(service).to receive(:execute).with(merge_request)
 
-          merge_when_build_succeeds
+          merge_when_pipeline_succeeds
         end
 
-        context 'when project.only_allow_merge_if_build_succeeds? is true' do
+        context 'when project.only_allow_merge_if_pipeline_succeeds? is true' do
           before do
-            project.update_column(:only_allow_merge_if_build_succeeds, true)
+            project.update_column(:only_allow_merge_if_pipeline_succeeds, true)
           end
 
-          it 'returns :merge_when_build_succeeds' do
-            merge_when_build_succeeds
+          it 'returns :merge_when_pipeline_succeeds' do
+            merge_when_pipeline_succeeds
 
-            expect(assigns(:status)).to eq(:merge_when_build_succeeds)
+            expect(assigns(:status)).to eq(:merge_when_pipeline_succeeds)
           end
         end
       end
@@ -425,7 +447,7 @@ describe Projects::MergeRequestsController do
 
   describe "DELETE destroy" do
     it "denies access to users unless they're admin or project owner" do
-      delete :destroy, namespace_id: project.namespace.path, project_id: project.path, id: merge_request.iid
+      delete :destroy, namespace_id: project.namespace, project_id: project, id: merge_request.iid
 
       expect(response).to have_http_status(404)
     end
@@ -438,7 +460,7 @@ describe Projects::MergeRequestsController do
       before { sign_in owner }
 
       it "deletes the merge request" do
-        delete :destroy, namespace_id: project.namespace.path, project_id: project.path, id: merge_request.iid
+        delete :destroy, namespace_id: project.namespace, project_id: project, id: merge_request.iid
 
         expect(response).to have_http_status(302)
         expect(controller).to set_flash[:notice].to(/The merge request was successfully deleted\./).now
@@ -447,7 +469,7 @@ describe Projects::MergeRequestsController do
       it 'delegates the update of the todos count cache to TodoService' do
         expect_any_instance_of(TodoService).to receive(:destroy_merge_request).with(merge_request, owner).once
 
-        delete :destroy, namespace_id: project.namespace.path, project_id: project.path, id: merge_request.iid
+        delete :destroy, namespace_id: project.namespace, project_id: project, id: merge_request.iid
       end
     end
   end
@@ -456,7 +478,7 @@ describe Projects::MergeRequestsController do
     def go(extra_params = {})
       params = {
         namespace_id: project.namespace.to_param,
-        project_id: project.to_param,
+        project_id: project,
         id: merge_request.iid
       }
 
@@ -536,7 +558,7 @@ describe Projects::MergeRequestsController do
     def diff_for_path(extra_params = {})
       params = {
         namespace_id: project.namespace.to_param,
-        project_id: project.to_param
+        project_id: project
       }
 
       get :diff_for_path, params.merge(extra_params)
@@ -600,7 +622,7 @@ describe Projects::MergeRequestsController do
 
         before do
           other_project.team << [user, :master]
-          diff_for_path(id: merge_request.iid, old_path: existing_path, new_path: existing_path, project_id: other_project.to_param)
+          diff_for_path(id: merge_request.iid, old_path: existing_path, new_path: existing_path, project_id: other_project)
         end
 
         it 'returns a 404' do
@@ -666,7 +688,7 @@ describe Projects::MergeRequestsController do
     def go(format: 'html')
       get :commits,
           namespace_id: project.namespace.to_param,
-          project_id: project.to_param,
+          project_id: project,
           id: merge_request.iid,
           format: format
     end
@@ -706,7 +728,7 @@ describe Projects::MergeRequestsController do
       before do
         get :pipelines,
             namespace_id: project.namespace.to_param,
-            project_id: project.to_param,
+            project_id: project,
             id: merge_request.iid,
             format: :json
       end
@@ -725,7 +747,7 @@ describe Projects::MergeRequestsController do
 
         get :conflicts,
             namespace_id: merge_request_with_conflicts.project.namespace.to_param,
-            project_id: merge_request_with_conflicts.project.to_param,
+            project_id: merge_request_with_conflicts.project,
             id: merge_request_with_conflicts.iid,
             format: 'json'
       end
@@ -743,7 +765,7 @@ describe Projects::MergeRequestsController do
       before do
         get :conflicts,
             namespace_id: merge_request_with_conflicts.project.namespace.to_param,
-            project_id: merge_request_with_conflicts.project.to_param,
+            project_id: merge_request_with_conflicts.project,
             id: merge_request_with_conflicts.iid,
             format: 'json'
       end
@@ -772,7 +794,7 @@ describe Projects::MergeRequestsController do
 
             section['lines'].each do |line|
               if section['conflict']
-                expect(line['type']).to be_in(['old', 'new'])
+                expect(line['type']).to be_in(%w(old new))
                 expect(line.values_at('old_line', 'new_line')).to contain_exactly(nil, a_kind_of(Integer))
               else
                 if line['type'].nil?
@@ -806,7 +828,7 @@ describe Projects::MergeRequestsController do
 
       post :remove_wip,
            namespace_id: merge_request.project.namespace.to_param,
-           project_id: merge_request.project.to_param,
+           project_id: merge_request.project,
            id: merge_request.iid
 
       expect(merge_request.reload.title).to eq(merge_request.wipless_title)
@@ -817,7 +839,7 @@ describe Projects::MergeRequestsController do
     def conflict_for_path(path)
       get :conflict_for_path,
           namespace_id: merge_request_with_conflicts.project.namespace.to_param,
-          project_id: merge_request_with_conflicts.project.to_param,
+          project_id: merge_request_with_conflicts.project,
           id: merge_request_with_conflicts.iid,
           old_path: path,
           new_path: path,
@@ -873,7 +895,7 @@ describe Projects::MergeRequestsController do
     def resolve_conflicts(files)
       post :resolve_conflicts,
            namespace_id: merge_request_with_conflicts.project.namespace.to_param,
-           project_id: merge_request_with_conflicts.project.to_param,
+           project_id: merge_request_with_conflicts.project,
            id: merge_request_with_conflicts.iid,
            format: 'json',
            files: files,
@@ -1024,7 +1046,7 @@ describe Projects::MergeRequestsController do
 
       post :assign_related_issues,
            namespace_id: project.namespace.to_param,
-           project_id: project.to_param,
+           project_id: project,
            id: merge_request.iid
     end
 
@@ -1079,7 +1101,7 @@ describe Projects::MergeRequestsController do
 
         get :ci_environments_status,
           namespace_id: merge_request.project.namespace.to_param,
-          project_id: merge_request.project.to_param,
+          project_id: merge_request.project,
           id: merge_request.iid, format: 'json'
       end
 
@@ -1092,8 +1114,8 @@ describe Projects::MergeRequestsController do
   describe 'GET merge_widget_refresh' do
     let(:params) do
       {
-        namespace_id: project.namespace.path,
-        project_id: project.path,
+        namespace_id: project.namespace,
+        project_id: project,
         id: merge_request.iid,
         format: :raw
       }
@@ -1131,14 +1153,14 @@ describe Projects::MergeRequestsController do
     end
 
     context 'when waiting for build' do
-      let(:merge_request) { create(:merge_request, source_project: project, merge_when_build_succeeds: true, merge_user: user) }
+      let(:merge_request) { create(:merge_request, source_project: project, merge_when_pipeline_succeeds: true, merge_user: user) }
 
       it 'returns an OK response' do
         expect(response).to have_http_status(:ok)
       end
 
-      it 'sets status to :merge_when_build_succeeds' do
-        expect(assigns(:status)).to eq(:merge_when_build_succeeds)
+      it 'sets status to :merge_when_pipeline_succeeds' do
+        expect(assigns(:status)).to eq(:merge_when_pipeline_succeeds)
         expect(response).to render_template('merge')
       end
     end