Check permissions before showing a forked project's source

See merge request gitlab/gitlabhq!3555

Ensure attributes that end in `_ids` are cleaned

See merge request gitlab/gitlabhq!3558

This prevents an issue where you can steal other projects objects by
asking for ids that don't belong to you in import.

[ci skip]

[ci skip]

[ci skip]

[ci skip]

Mask Sentry auth token

See merge request gitlab/gitlabhq!3504

Private/internal repository enumeration via bruteforce on a vulnerable URL

See merge request gitlab/gitlabhq!3491

Return 404 on LFS request if project doesn't exist

See merge request gitlab/gitlabhq!3506

Only assign merge params when allowed

See merge request gitlab/gitlabhq!3487

Pass all wiki markup formats through our Banzai pipeline filters

See merge request gitlab/gitlabhq!3485

Require Maintainer permission on group where project is transferred to

See merge request gitlab/gitlabhq!3486

Use the '\A' and '\z' regex anchors in `InternalRedirect` to mitigate an Open Redirect issue.

See merge request gitlab/gitlabhq!3488

Merge branch 'security-2914-labels-visible-despite-no-access-to-issues-repositories-12-4' into '12-4-stable'

Labels visible despite no access to issues & repositories

See merge request gitlab/gitlabhq!3489

Project path reveals labels from Private project if the issue is moved to public project

See merge request gitlab/gitlabhq!3490

Nested GraphQL query with circular relationship can cause Denial of Service

See merge request gitlab/gitlabhq!3492

Filter out search results based on permissions to avoid bugs leaking data

See merge request gitlab/gitlabhq!3496

Merge branch 'security-65756-ex-admin-attacker-can-comment-in-internalsecurity-65756-ex-admin-attacker-can-comment-in-internal-12-4' into '12-4-stable'

Improper access control allows the attacker to comment in internal commit after they are no longer admin

See merge request gitlab/gitlabhq!3497

Merge branch 'security-ag-hide-private-members-in-project-member-autocomplete-12-4' into '12-4-stable'

Hide private members in project member autocomplete

See merge request gitlab/gitlabhq!3503

This makes it so we mask Sentry's auth token. This mask only occurs in
the UI.