14 files changed, 230 insertions, 55 deletions

diff --git a/app/controllers/concerns/creates_commit.rb b/app/controllers/concerns/creates_commit.rb
index dacb5679dd3..6f43ce5226d 100644
--- a/app/controllers/concerns/creates_commit.rb
+++ b/app/controllers/concerns/creates_commit.rb
@@ -81,10 +81,8 @@ module CreatesCommit
   def merge_request_exists?
     return @merge_request if defined?(@merge_request)
 
-    @merge_request = @mr_target_project.merge_requests.opened.find_by(
-      source_branch: @mr_source_branch,
-      target_branch: @mr_target_branch
-    )
+    @merge_request = MergeRequestsFinder.new(current_user, project_id: @mr_target_project.id).execute.opened.
+      find_by(source_branch: @mr_source_branch, target_branch: @mr_target_branch, source_project_id: @mr_source_project)
   end
 
   def different_project?
diff --git a/app/controllers/concerns/cycle_analytics_params.rb b/app/controllers/concerns/cycle_analytics_params.rb
new file mode 100644
index 00000000000..52e06f4945a
--- /dev/null
+++ b/app/controllers/concerns/cycle_analytics_params.rb
@@ -0,0 +1,11 @@
+module CycleAnalyticsParams
+  extend ActiveSupport::Concern
+
+  def options(params)
+    @options ||= { from: start_date(params), current_user: current_user }
+  end
+
+  def start_date(params)
+    params[:start_date] == '30' ? 30.days.ago : 90.days.ago
+  end
+end
diff --git a/app/controllers/concerns/diff_for_path.rb b/app/controllers/concerns/diff_for_path.rb
index aeec3009f15..1efa9fe060f 100644
--- a/app/controllers/concerns/diff_for_path.rb
+++ b/app/controllers/concerns/diff_for_path.rb
@@ -3,7 +3,7 @@ module DiffForPath
 
   def render_diff_for_path(diffs)
     diff_file = diffs.diff_files.find do |diff|
-      diff.old_path == params[:old_path] && diff.new_path == params[:new_path]
+      diff.file_identifier == params[:file_identifier]
     end
 
     return render_404 unless diff_file
diff --git a/app/controllers/concerns/global_milestones.rb b/app/controllers/concerns/global_milestones.rb
deleted file mode 100644
index 5c503c5b698..00000000000
--- a/app/controllers/concerns/global_milestones.rb
+++ /dev/null
@@ -1,20 +0,0 @@
-module GlobalMilestones
-  extend ActiveSupport::Concern
-
-  def milestones
-    epoch = DateTime.parse('1970-01-01')
-    @milestones = MilestonesFinder.new.execute(@projects, params)
-    @milestones = GlobalMilestone.build_collection(@milestones)
-    @milestones = @milestones.sort_by { |x| x.due_date.nil? ? epoch : x.due_date }
-  end
-
-  def milestone
-    milestones = Milestone.of_projects(@projects).where(title: params[:title])
-
-    if milestones.present?
-      @milestone = GlobalMilestone.new(params[:title], milestones)
-    else
-      render_404
-    end
-  end
-end
diff --git a/app/controllers/concerns/issuable_actions.rb b/app/controllers/concerns/issuable_actions.rb
index be86fa106f8..0821974aa93 100644
--- a/app/controllers/concerns/issuable_actions.rb
+++ b/app/controllers/concerns/issuable_actions.rb
@@ -12,7 +12,7 @@ module IssuableActions
     destroy_method = "destroy_#{issuable.class.name.underscore}".to_sym
     TodoService.new.public_send(destroy_method, issuable, current_user)
 
-    name = issuable.class.name.titleize.downcase
+    name = issuable.human_class_name
     flash[:notice] = "The #{name} was successfully deleted."
     redirect_to polymorphic_path([@project.namespace.becomes(Namespace), @project, issuable.class])
   end
diff --git a/app/controllers/concerns/issuable_collections.rb b/app/controllers/concerns/issuable_collections.rb
index b5e79099e39..6247934f81e 100644
--- a/app/controllers/concerns/issuable_collections.rb
+++ b/app/controllers/concerns/issuable_collections.rb
@@ -10,11 +10,11 @@ module IssuableCollections
   private
 
   def issues_collection
-    issues_finder.execute
+    issues_finder.execute.preload(:project, :author, :assignee, :labels, :milestone, project: :namespace)
   end
 
   def merge_requests_collection
-    merge_requests_finder.execute
+    merge_requests_finder.execute.preload(:source_project, :target_project, :author, :assignee, :labels, :milestone, :merge_request_diff, target_project: :namespace)
   end
 
   def issues_finder
diff --git a/app/controllers/concerns/issues_action.rb b/app/controllers/concerns/issues_action.rb
index b89fb94be6e..b46adcceb60 100644
--- a/app/controllers/concerns/issues_action.rb
+++ b/app/controllers/concerns/issues_action.rb
@@ -7,7 +7,6 @@ module IssuesAction
 
     @issues = issues_collection
               .non_archived
-              .preload(:author, :project)
               .page(params[:page])
 
     respond_to do |format|
diff --git a/app/controllers/concerns/lfs_request.rb b/app/controllers/concerns/lfs_request.rb
new file mode 100644
index 00000000000..ed22b1e5470
--- /dev/null
+++ b/app/controllers/concerns/lfs_request.rb
@@ -0,0 +1,109 @@
+# This concern assumes:
+# - a `#project` accessor
+# - a `#user` accessor
+# - a `#authentication_result` accessor
+# - a `#can?(object, action, subject)` method
+# - a `#ci?` method
+# - a `#download_request?` method
+# - a `#upload_request?` method
+# - a `#has_authentication_ability?(ability)` method
+module LfsRequest
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :require_lfs_enabled!
+    before_action :lfs_check_access!
+  end
+
+  private
+
+  def require_lfs_enabled!
+    return if Gitlab.config.lfs.enabled
+
+    render(
+      json: {
+        message: 'Git LFS is not enabled on this GitLab server, contact your admin.',
+        documentation_url: help_url,
+      },
+      status: 501
+    )
+  end
+
+  def lfs_check_access!
+    return if download_request? && lfs_download_access?
+    return if upload_request? && lfs_upload_access?
+
+    if project.public? || can?(user, :read_project, project)
+      lfs_forbidden!
+    else
+      render_lfs_not_found
+    end
+  end
+
+  def lfs_forbidden!
+    render_lfs_forbidden
+  end
+
+  def render_lfs_forbidden
+    render(
+      json: {
+        message: 'Access forbidden. Check your access level.',
+        documentation_url: help_url,
+      },
+      content_type: "application/vnd.git-lfs+json",
+      status: 403
+    )
+  end
+
+  def render_lfs_not_found
+    render(
+      json: {
+        message: 'Not found.',
+        documentation_url: help_url,
+      },
+      content_type: "application/vnd.git-lfs+json",
+      status: 404
+    )
+  end
+
+  def lfs_download_access?
+    return false unless project.lfs_enabled?
+
+    ci? || lfs_deploy_token? || user_can_download_code? || build_can_download_code?
+  end
+
+  def lfs_upload_access?
+    return false unless project.lfs_enabled?
+
+    has_authentication_ability?(:push_code) && can?(user, :push_code, project)
+  end
+
+  def lfs_deploy_token?
+    authentication_result.lfs_deploy_token?(project)
+  end
+
+  def user_can_download_code?
+    has_authentication_ability?(:download_code) && can?(user, :download_code, project)
+  end
+
+  def build_can_download_code?
+    has_authentication_ability?(:build_download_code) && can?(user, :build_download_code, project)
+  end
+
+  def storage_project
+    @storage_project ||= begin
+      result = project
+
+      loop do
+        break unless result.forked?
+        result = result.forked_from_project
+      end
+
+      result
+    end
+  end
+
+  def objects
+    @objects ||= (params[:objects] || []).to_a
+  end
+end
diff --git a/app/controllers/concerns/merge_requests_action.rb b/app/controllers/concerns/merge_requests_action.rb
index a1b0eee37f9..fdb05bb3228 100644
--- a/app/controllers/concerns/merge_requests_action.rb
+++ b/app/controllers/concerns/merge_requests_action.rb
@@ -6,8 +6,12 @@ module MergeRequestsAction
     @label = merge_requests_finder.labels.first
 
     @merge_requests = merge_requests_collection
-                      .non_archived
-                      .preload(:author, :target_project)
                       .page(params[:page])
   end
+
+  private
+
+  def filter_params
+    super.merge(non_archived: true)
+  end
 end
diff --git a/app/controllers/concerns/oauth_applications.rb b/app/controllers/concerns/oauth_applications.rb
new file mode 100644
index 00000000000..9849aa93fa6
--- /dev/null
+++ b/app/controllers/concerns/oauth_applications.rb
@@ -0,0 +1,19 @@
+module OauthApplications
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :prepare_scopes, only: [:create, :update]
+  end
+
+  def prepare_scopes
+    scopes = params.fetch(:doorkeeper_application, {}).fetch(:scopes, nil)
+
+    if scopes
+      params[:doorkeeper_application][:scopes] = scopes.join(' ')
+    end
+  end
+
+  def load_scopes
+    @scopes = Doorkeeper.configuration.scopes
+  end
+end
diff --git a/app/controllers/concerns/service_params.rb b/app/controllers/concerns/service_params.rb
index c33d7eecb9f..d7f5a4e4682 100644
--- a/app/controllers/concerns/service_params.rb
+++ b/app/controllers/concerns/service_params.rb
@@ -1,31 +1,72 @@
 module ServiceParams
   extend ActiveSupport::Concern
 
-  ALLOWED_PARAMS = [:title, :token, :type, :active, :api_key, :api_url, :api_version, :subdomain,
-                    :room, :recipients, :project_url, :webhook,
-                    :user_key, :device, :priority, :sound, :bamboo_url, :username, :password,
-                    :build_key, :server, :teamcity_url, :drone_url, :build_type,
-                    :description, :issues_url, :new_issue_url, :restrict_to_branch, :channel,
-                    :colorize_messages, :channels,
-                    # We're using `issues_events` and `merge_requests_events`
-                    # in the view so we still need to explicitly state them
-                    # here. `Service#event_names` would only give
-                    # `issue_events` and `merge_request_events` (singular!)
-                    # See app/helpers/services_helper.rb for how we
-                    # make those event names plural as special case.
-                    :issues_events, :confidential_issues_events, :merge_requests_events,
-                    :notify_only_broken_builds, :notify_only_broken_pipelines,
-                    :add_pusher, :send_from_committer_email, :disable_diffs,
-                    :external_wiki_url, :notify, :color,
-                    :server_host, :server_port, :default_irc_uri, :enable_ssl_verification,
-                    :jira_issue_transition_id, :url, :project_key]
+  ALLOWED_PARAMS_CE = [
+    :active,
+    :add_pusher,
+    :api_key,
+    :api_url,
+    :api_version,
+    :bamboo_url,
+    :build_key,
+    :build_type,
+    :ca_pem,
+    :channel,
+    :channels,
+    :color,
+    :colorize_messages,
+    :confidential_issues_events,
+    :default_irc_uri,
+    :description,
+    :device,
+    :disable_diffs,
+    :drone_url,
+    :enable_ssl_verification,
+    :external_wiki_url,
+    # We're using `issues_events` and `merge_requests_events`
+    # in the view so we still need to explicitly state them
+    # here. `Service#event_names` would only give
+    # `issue_events` and `merge_request_events` (singular!)
+    # See app/helpers/services_helper.rb for how we
+    # make those event names plural as special case.
+    :issues_events,
+    :issues_url,
+    :jira_issue_transition_id,
+    :merge_requests_events,
+    :namespace,
+    :new_issue_url,
+    :notify,
+    :notify_only_broken_builds,
+    :notify_only_broken_pipelines,
+    :password,
+    :priority,
+    :project_key,
+    :project_url,
+    :recipients,
+    :restrict_to_branch,
+    :room,
+    :send_from_committer_email,
+    :server,
+    :server_host,
+    :server_port,
+    :sound,
+    :subdomain,
+    :teamcity_url,
+    :title,
+    :token,
+    :type,
+    :url,
+    :user_key,
+    :username,
+    :webhook
+  ]
 
   # Parameters to ignore if no value is specified
   FILTER_BLANK_PARAMS = [:password]
 
   def service_params
     dynamic_params = @service.event_channel_names + @service.event_names
-    service_params = params.permit(:id, service: ALLOWED_PARAMS + dynamic_params)
+    service_params = params.permit(:id, service: ALLOWED_PARAMS_CE + dynamic_params)
 
     if service_params[:service].is_a?(Hash)
       FILTER_BLANK_PARAMS.each do |param|
diff --git a/app/controllers/concerns/toggle_award_emoji.rb b/app/controllers/concerns/toggle_award_emoji.rb
index 3717c49f272..fbf9a026b10 100644
--- a/app/controllers/concerns/toggle_award_emoji.rb
+++ b/app/controllers/concerns/toggle_award_emoji.rb
@@ -1,11 +1,8 @@
 module ToggleAwardEmoji
   extend ActiveSupport::Concern
 
-  included do
-    before_action :authenticate_user!, only: [:toggle_award_emoji]
-  end
-
   def toggle_award_emoji
+    authenticate_user!
     name = params.require(:name)
 
     if awardable.user_can_award?(current_user, name)
diff --git a/app/controllers/concerns/toggle_subscription_action.rb b/app/controllers/concerns/toggle_subscription_action.rb
index 9e3b9be2ff4..92cb534343e 100644
--- a/app/controllers/concerns/toggle_subscription_action.rb
+++ b/app/controllers/concerns/toggle_subscription_action.rb
@@ -4,13 +4,17 @@ module ToggleSubscriptionAction
   def toggle_subscription
     return unless current_user
 
-    subscribable_resource.toggle_subscription(current_user)
+    subscribable_resource.toggle_subscription(current_user, subscribable_project)
 
     head :ok
   end
 
   private
 
+  def subscribable_project
+    @project || raise(NotImplementedError)
+  end
+
   def subscribable_resource
     raise NotImplementedError
   end
diff --git a/app/controllers/concerns/workhorse_request.rb b/app/controllers/concerns/workhorse_request.rb
new file mode 100644
index 00000000000..43c0f1b173c
--- /dev/null
+++ b/app/controllers/concerns/workhorse_request.rb
@@ -0,0 +1,13 @@
+module WorkhorseRequest
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :verify_workhorse_api!
+  end
+
+  private
+
+  def verify_workhorse_api!
+    Gitlab::Workhorse.verify_api_request!(request.headers)
+  end
+end