Merge branch 'master' into refactor/ci-config-move-job-entries

* master: (522 commits)
  Fix CI yaml example
  Align cancel and retry buttons
  Remove deploy to production button
  Fix a bug where the project's repository path was returned instead of the wiki path
  Don't fail to highlight when Rouge doesn't have a lexer
  Revert "Merge branch 'gl-dropdown-issuable-form' into 'master'"
  Update tests
  Don't fail when Ci::Pipeline doesn't have a project
  Don't fail when a LegacyDiffNote didn't store the right diff
  Update CHANGELOG
  Use cattr_accessor instead duplicating code on NoteOnDiff concern
  Fix mentioned users list on diff notes
  Don't ask Heather to review documentation MR's
  add project name and namespace to filename on project export
  navbar_icon was renamed to custom_icon in:
  use %(...) and %[...] in favor of %<...>
  Fix spec Don't attempt to disable statement timeout on a MySQL DB
  Disable statement timeout outside of transaction and during adding concurrent index
  Disable PostgreSQL statement timeout during migrations
  Add visibility icon
  ...

.hound.yml

-# Prefer single quotes
-StringLiterals:
-  EnforcedStyle: single_quotes
-  Enabled: true

.teatro.yml

-stage:
-  before:
-    - cp config/gitlab.teatro.yml config/gitlab.yml
-    - mkdir /apps/gitlab-satellites
-    - mkdir /apps/repositories
-    
-  database:
-    - RAILS_ENV=development force=yes bundle exec rake db:create gitlab:setup
\ No newline at end of file

CONTRIBUTING.md

@@ -145,7 +145,8 @@ might be edited to make them small and simple.
 You are encouraged to use the template below for feature proposals.
 
 ```
-## Description including problem, use cases, benefits, and/or goals
+## Description
+Include problem, use cases, benefits, and/or goals
 
 ## Proposal
 

GITLAB_SHELL_VERSION

-3.1.0
+3.2.0

GITLAB_WORKHORSE_VERSION

-0.7.7
+0.7.8

Gemfile

-source "https://rubygems.org"
+source 'https://rubygems.org'
 
-gem 'rails', '4.2.6'
+gem 'rails', '4.2.7'
 gem 'rails-deprecated_sanitizer', '~> 1.0.3'
 
 # Responders respond_to and respond_with
@@ -11,15 +11,15 @@ gem 'responders', '~> 2.0'
 gem 'sprockets', '~> 3.6.0'
 
 # Default values for AR models
-gem "default_value_for", "~> 3.0.0"
+gem 'default_value_for', '~> 3.0.0'
 
 # Supported DBs
-gem "mysql2", '~> 0.3.16', group: :mysql
-gem "pg", '~> 0.18.2', group: :postgres
+gem 'mysql2', '~> 0.3.16', group: :mysql
+gem 'pg', '~> 0.18.2', group: :postgres
 
 # Authentication libraries
 gem 'devise',                 '~> 4.0'
-gem 'doorkeeper',             '~> 3.1'
+gem 'doorkeeper',             '~> 4.0'
 gem 'omniauth',               '~> 1.3.1'
 gem 'omniauth-auth0',         '~> 1.4.1'
 gem 'omniauth-azure-oauth2',  '~> 0.0.6'
@@ -28,7 +28,7 @@ gem 'omniauth-cas3',          '~> 1.1.2'
 gem 'omniauth-facebook',      '~> 3.0.0'
 gem 'omniauth-github',        '~> 1.1.1'
 gem 'omniauth-gitlab',        '~> 1.0.0'
-gem 'omniauth-google-oauth2', '~> 0.2.0'
+gem 'omniauth-google-oauth2', '~> 0.4.1'
 gem 'omniauth-kerberos',      '~> 0.3.0', group: :kerberos
 gem 'omniauth-saml',          '~> 1.6.0'
 gem 'omniauth-shibboleth',    '~> 1.2.0'
@@ -48,24 +48,24 @@ gem 'attr_encrypted', '~> 3.0.0'
 gem 'u2f', '~> 0.2.1'
 
 # Browser detection
-gem "browser", '~> 2.2'
+gem 'browser', '~> 2.2'
 
 # Extracting information from a git repository
 # Provide access to Gitlab::Git library
-gem "gitlab_git", '~> 10.2'
+gem 'gitlab_git', '~> 10.2'
 
 # LDAP Auth
 # GitLab fork with several improvements to original library. For full list of changes
 # see https://github.com/intridea/omniauth-ldap/compare/master...gitlabhq:master
-gem 'gitlab_omniauth-ldap', '~> 1.2.1', require: "omniauth-ldap"
+gem 'gitlab_omniauth-ldap', '~> 1.2.1', require: 'omniauth-ldap'
 
 # Git Wiki
 # Required manually in config/initializers/gollum.rb to control load order
-gem 'gollum-lib', '~> 4.1.0', require: false
+gem 'gollum-lib', '~> 4.2', require: false
 gem 'gollum-rugged_adapter', '~> 0.4.2', require: false
 
 # Language detection
-gem "github-linguist", "~> 4.7.0", require: "linguist"
+gem 'github-linguist', '~> 4.7.0', require: 'linguist'
 
 # API
 gem 'grape',        '~> 0.13.0'
@@ -73,13 +73,13 @@ gem 'grape-entity', '~> 0.4.2'
 gem 'rack-cors',    '~> 0.4.0', require: 'rack/cors'
 
 # Pagination
-gem "kaminari", "~> 0.17.0"
+gem 'kaminari', '~> 0.17.0'
 
 # HAML
 gem 'hamlit', '~> 2.5'
 
 # Files attachments
-gem "carrierwave", '~> 0.10.0'
+gem 'carrierwave', '~> 0.10.0'
 
 # Drag and Drop UI
 gem 'dropzonejs-rails', '~> 0.7.1'
@@ -94,18 +94,18 @@ gem 'fog-openstack', '~> 0.1'
 gem 'fog-rackspace', '~> 0.1.1'
 
 # for aws storage
-gem "unf", '~> 0.1.4'
+gem 'unf', '~> 0.1.4'
 
 # Authorization
-gem "six", '~> 0.2.0'
+gem 'six', '~> 0.2.0'
 
 # Seed data
-gem "seed-fu", '~> 2.3.5'
+gem 'seed-fu', '~> 2.3.5'
 
 # Markdown and HTML processing
 gem 'html-pipeline', '~> 1.11.0'
 gem 'task_list',     '~> 1.0.2', require: 'task_list/railtie'
-gem 'github-markup', '~> 1.3.1'
+gem 'github-markup', '~> 1.4'
 gem 'redcarpet',     '~> 3.3.3'
 gem 'RedCloth',      '~> 4.3.2'
 gem 'rdoc',          '~>3.6'
@@ -113,7 +113,7 @@ gem 'org-ruby',      '~> 0.9.12'
 gem 'creole',        '~> 0.5.0'
 gem 'wikicloth',     '0.8.1'
 gem 'asciidoctor',   '~> 1.5.2'
-gem 'rouge',         '~> 1.11'
+gem 'rouge',         '~> 2.0'
 
 # See https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s
 # and https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM
@@ -124,29 +124,29 @@ gem 'diffy', '~> 3.0.3'
 
 # Application server
 group :unicorn do
-  gem "unicorn", '~> 4.9.0'
+  gem 'unicorn', '~> 4.9.0'
   gem 'unicorn-worker-killer', '~> 0.4.2'
 end
 
 # State machine
-gem "state_machines-activerecord", '~> 0.4.0'
+gem 'state_machines-activerecord', '~> 0.4.0'
 # Run events after state machine commits
-gem 'after_commit_queue'
+gem 'after_commit_queue', '~> 1.3.0'
 
 # Issue tags
 gem 'acts-as-taggable-on', '~> 3.4'
 
 # Background jobs
-gem 'sinatra', '~> 1.4.4', require: nil
+gem 'sinatra', '~> 1.4.4', require: false
 gem 'sidekiq', '~> 4.0'
 gem 'sidekiq-cron', '~> 0.4.0'
-gem 'redis-namespace'
+gem 'redis-namespace', '~> 1.5.2'
 
 # HTTP requests
-gem "httparty", '~> 0.13.3'
+gem 'httparty', '~> 0.13.3'
 
 # Colored output to console
-gem "rainbow", '~> 2.1.0'
+gem 'rainbow', '~> 2.1.0'
 
 # GitLab settings
 gem 'settingslogic', '~> 2.0.9'
@@ -156,7 +156,7 @@ gem 'settingslogic', '~> 2.0.9'
 gem 'version_sorter', '~> 2.0.0'
 
 # Cache
-gem "redis-rails", '~> 4.0.0'
+gem 'redis-rails', '~> 4.0.0'
 
 # Redis
 gem 'redis', '~> 3.2'
@@ -169,13 +169,13 @@ gem 'tinder', '~> 1.10.0'
 gem 'hipchat', '~> 1.5.0'
 
 # Flowdock integration
-gem "gitlab-flowdock-git-hook", "~> 1.0.1"
+gem 'gitlab-flowdock-git-hook', '~> 1.0.1'
 
 # Gemnasium integration
-gem "gemnasium-gitlab-service", "~> 0.2"
+gem 'gemnasium-gitlab-service', '~> 0.2'
 
 # Slack integration
-gem "slack-notifier", "~> 1.2.0"
+gem 'slack-notifier', '~> 1.2.0'
 
 # Asana integration
 gem 'asana', '~> 0.4.0'
@@ -187,20 +187,20 @@ gem 'ruby-fogbugz', '~> 0.2.1'
 gem 'd3_rails', '~> 3.5.0'
 
 # underscore-rails
-gem "underscore-rails", "~> 1.8.0"
+gem 'underscore-rails', '~> 1.8.0'
 
 # Sanitize user input
-gem "sanitize", '~> 2.0'
+gem 'sanitize', '~> 2.0'
 gem 'babosa', '~> 1.0.2'
 
 # Sanitizes SVG input
-gem "loofah", "~> 2.0.3"
+gem 'loofah', '~> 2.0.3'
 
 # Working with license
 gem 'licensee', '~> 8.0.0'
 
 # Protect against bruteforcing
-gem "rack-attack", '~> 4.3.1'
+gem 'rack-attack', '~> 4.3.1'
 
 # Ace editor
 gem 'ace-rails-ap', '~> 4.0.2'
@@ -214,16 +214,16 @@ gem 'charlock_holmes', '~> 0.7.3'
 # Parse duration
 gem 'chronic_duration', '~> 0.10.6'
 
-gem "sass-rails", '~> 5.0.0'
-gem "coffee-rails", '~> 4.1.0'
-gem "uglifier", '~> 2.7.2'
+gem 'sass-rails', '~> 5.0.0'
+gem 'coffee-rails', '~> 4.1.0'
+gem 'uglifier', '~> 2.7.2'
 gem 'turbolinks', '~> 2.5.0'
 gem 'jquery-turbolinks', '~> 2.1.0'
 
 gem 'addressable',        '~> 2.3.8'
 gem 'bootstrap-sass',     '~> 3.3.0'
 gem 'font-awesome-rails', '~> 4.6.1'
-gem 'gitlab_emoji',       '~> 0.3.0'
+gem 'gemojione',          '~> 2.6'
 gem 'gon',                '~> 6.0.1'
 gem 'jquery-atwho-rails', '~> 1.3.2'
 gem 'jquery-rails',       '~> 4.1.0'
@@ -247,13 +247,13 @@ group :metrics do
 end
 
 group :development do
-  gem "foreman"
+  gem 'foreman', '~> 0.78.0'
   gem 'brakeman', '~> 3.3.0', require: false
 
   gem 'letter_opener_web', '~> 1.3.0'
   gem 'rerun', '~> 0.11.0'
-  gem 'bullet', require: false
-  gem 'rblineprof', platform: :mri, require: false
+  gem 'bullet', '~> 5.0.0', require: false
+  gem 'rblineprof', '~> 0.3.6', platform: :mri, require: false
   gem 'web-console', '~> 2.0'
 
   # Better errors handler
@@ -261,15 +261,15 @@ group :development do
   gem 'binding_of_caller', '~> 0.7.2'
 
   # Docs generator
-  gem "sdoc", '~> 0.3.20'
+  gem 'sdoc', '~> 0.3.20'
 
   # thin instead webrick
   gem 'thin', '~> 1.7.0'
 end
 
 group :development, :test do
-  gem 'byebug', platform: :mri
-  gem 'pry-rails'
+  gem 'byebug', '~> 8.2.1', platform: :mri
+  gem 'pry-rails', '~> 0.3.4'
 
   gem 'awesome_print', '~> 1.2.0', require: false
   gem 'fuubar', '~> 2.0.0'
@@ -277,7 +277,7 @@ group :development, :test do
   gem 'database_cleaner',   '~> 1.4.0'
   gem 'factory_girl_rails', '~> 4.6.0'
   gem 'rspec-rails',        '~> 3.5.0'
-  gem 'rspec-retry'
+  gem 'rspec-retry',        '~> 0.4.5'
   gem 'spinach-rails',      '~> 0.2.1'
   gem 'spinach-rerun-reporter', '~> 0.0.2'
 
@@ -299,18 +299,18 @@ group :development, :test do
   gem 'spring-commands-spinach',  '~> 1.1.0'
   gem 'spring-commands-teaspoon', '~> 0.0.2'
 
-  gem 'rubocop', '~> 0.40.0', require: false
+  gem 'rubocop', '~> 0.41.2', require: false
   gem 'rubocop-rspec', '~> 1.5.0', require: false
   gem 'scss_lint', '~> 0.47.0', require: false
   gem 'simplecov', '~> 0.11.0', require: false
-  gem 'flog', require: false
-  gem 'flay', require: false
-  gem 'bundler-audit', require: false
+  gem 'flog', '~> 4.3.2', require: false
+  gem 'flay', '~> 2.6.1', require: false
+  gem 'bundler-audit', '~> 0.5.0', require: false
 
-  gem 'benchmark-ips', require: false
+  gem 'benchmark-ips', '~> 2.3.0', require: false
 
-  gem "license_finder", require: false
-  gem 'knapsack'
+  gem 'license_finder', '~> 2.1.0', require: false
+  gem 'knapsack', '~> 1.11.0'
 end
 
 group :test do
@@ -318,33 +318,33 @@ group :test do
   gem 'email_spec', '~> 1.6.0'
   gem 'webmock', '~> 1.21.0'
   gem 'test_after_commit', '~> 0.4.2'
-  gem 'sham_rack'
+  gem 'sham_rack', '~> 1.3.6'
 end
 
 group :production do
-  gem "gitlab_meta", '7.0'
+  gem 'gitlab_meta', '7.0'
 end
 
-gem "newrelic_rpm", '~> 3.14'
+gem 'newrelic_rpm', '~> 3.14'
 
 gem 'octokit', '~> 4.3.0'
 
-gem "mail_room", "~> 0.8"
+gem 'mail_room', '~> 0.8'
 
 gem 'email_reply_parser', '~> 0.5.8'
 
 ## CI
 gem 'activerecord-session_store', '~> 1.0.0'
-gem "nested_form", '~> 0.3.2'
+gem 'nested_form', '~> 0.3.2'
 
 # OAuth
-gem 'oauth2', '~> 1.0.0'
+gem 'oauth2', '~> 1.2.0'
 
 # Soft deletion
-gem "paranoia", "~> 2.0"
+gem 'paranoia', '~> 2.0'
 
 # Health check
-gem 'health_check', '~> 1.5.1'
+gem 'health_check', '~> 2.1.0'
 
 # System information
 gem 'vmstat', '~> 2.1.0'

app/assets/javascripts/api.js.coffee

@@ -3,7 +3,7 @@
   groupPath: "/api/:version/groups/:id.json"
   namespacesPath: "/api/:version/namespaces.json"
   groupProjectsPath: "/api/:version/groups/:id/projects.json"
-  projectsPath: "/api/:version/projects.json"
+  projectsPath: "/api/:version/projects.json?simple=true"
   labelsPath: "/api/:version/projects/:id/labels"
   licensePath: "/api/:version/licenses/:key"
   gitignorePath: "/api/:version/gitignores/:key"

app/assets/javascripts/application.js.coffee

@@ -47,15 +47,12 @@
 #= require date.format
 #= require_directory ./behaviors
 #= require_directory ./blob
-#= require_directory ./ci
 #= require_directory ./commit
 #= require_directory ./extensions
 #= require_directory ./lib/utils
 #= require_directory ./u2f
 #= require_directory .
 #= require fuzzaldrin-plus
-#= require cropper
-#= require u2f
 
 window.slugify = (text) ->
   text.replace(/[^-a-zA-Z0-9]+/g, '_').toLowerCase()

app/assets/javascripts/ci/build.coffee → app/assets/javascripts/build.coffee

-class @CiBuild
+class @Build
   @interval: null
   @state: null
 
-  constructor: (@build_url, @build_status, @state) ->
-    clearInterval(CiBuild.interval)
+  constructor: (@page_url, @build_url, @build_status, @state) ->
+    clearInterval(Build.interval)
 
     # Init breakpoint checker
     @bp = Breakpoints.get()
@@ -40,8 +40,8 @@ class @CiBuild
       # Check for new build output if user still watching build page
       # Only valid for runnig build when output changes during time
       #
-      CiBuild.interval = setInterval =>
-        if window.location.href.split("#").first() is @build_url
+      Build.interval = setInterval =>
+        if window.location.href.split("#").first() is @page_url
           @getBuildTrace()
       , 4000
 
@@ -57,7 +57,7 @@ class @CiBuild
 
   getBuildTrace: ->
     $.ajax
-      url: "#{@build_url}/trace.json?state=#{encodeURIComponent(@state)}"
+      url: "#{@page_url}/trace.json?state=#{encodeURIComponent(@state)}"
       dataType: "json"
       success: (log) =>
         if log.state
@@ -70,7 +70,7 @@ class @CiBuild
             $('.js-build-output').html log.html
           @checkAutoscroll()
         else if log.status isnt @build_status
-          Turbolinks.visit @build_url
+          Turbolinks.visit @page_url
 
   checkAutoscroll: ->
     $("html,body").scrollTop $("#build-trace").height()  if "enabled" is $("#autoscroll-button").data("state")

app/assets/javascripts/ci/application.js.coffee

-#= require pager
-#= require jquery_nested_form
-#= require_tree .
-
-$(document).on 'click', '.assign-all-runner', ->
-  $(this).replaceWith('<i class="fa fa-refresh fa-spin"></i> Assign in progress..')
-
-window.unbindEvents = ->
-  $(document).unbind('scroll')
-  $(document).off('scroll')
-
-document.addEventListener("page:fetch", unbindEvents)

app/assets/javascripts/ci/projects.js.coffee

-$(document).on 'click', '.badge-codes-toggle', ->
-  $('.badge-codes-block').toggleClass("hide")
-  return false

app/assets/javascripts/compare_autocomplete.js.coffee

+class @CompareAutocomplete
+  constructor: ->
+    @initDropdown()
+
+  initDropdown: ->
+    $('.js-compare-dropdown').each ->
+      $dropdown = $(@)
+      selected = $dropdown.data('selected')
+
+      $dropdown.glDropdown(
+        data: (term, callback) ->
+          $.ajax(
+            url: $dropdown.data('refs-url')
+            data:
+              ref: $dropdown.data('ref')
+          ).done (refs) ->
+            callback(refs)
+        selectable: true
+        filterable: true
+        filterByText: true
+        fieldName: $dropdown.attr('name')
+        filterInput: 'input[type="text"]'
+        renderRow: (ref) ->
+          if ref.header?
+            $('<li />')
+              .addClass('dropdown-header')
+              .text(ref.header)
+          else
+            link = $('<a />')
+              .attr('href', '#')
+              .addClass(if ref is selected then 'is-active' else '')
+              .text(ref)
+              .attr('data-ref', escape(ref))
+
+            $('<li />')
+              .append(link)
+        id: (obj, $el) ->
+          $el.attr('data-ref')
+        toggleLabel: (obj, $el) ->
+          $el.text().trim()
+      )

app/assets/javascripts/diff.js.coffee

 class @Diff
   UNFOLD_COUNT = 20
   constructor: ->
+    $('.files .diff-file').singleFileDiff()
+    @filesCommentButton = $('.files .diff-file').filesCommentButton()
+
     $(document).off('click', '.js-unfold')
     $(document).on('click', '.js-unfold', (event) =>
       target = $(event.target)
@@ -36,7 +39,7 @@ class @Diff
         # see https://gitlab.com/gitlab-org/gitlab-ce/issues/707
         indent: 1
 
-      $.get(link, params, (response) =>
+      $.get(link, params, (response) ->
         target.parent().replaceWith(response)
       )
     )

app/assets/javascripts/dispatcher.js.coffee

@@ -127,17 +127,18 @@ class Dispatcher
           when 'groups'
             new UsersSelect()
           when 'projects'
-            new NamespaceSelect()
+            new NamespaceSelects()
       when 'dashboard', 'root'
         shortcut_handler = new ShortcutsDashboardNavigation()
       when 'profiles'
-        new Profile()
         new NotificationsForm()
         new NotificationsDropdown()
       when 'projects'
         new Project()
         new ProjectAvatar()
         switch path[1]
+          when 'compare'
+            new CompareAutocomplete()
           when 'edit'
             shortcut_handler = new ShortcutsNavigation()
             new ProjectNew()

app/assets/javascripts/dropzone_input.js.coffee

@@ -70,12 +70,12 @@ class @DropzoneInput
         pasteText response.link.markdown
         return
 
-      error: (temp, errorMessage) ->
+      error: (temp) ->
         errorAlert = $(form).find('.error-alert')
         checkIfMsgExists = errorAlert.children().length
         if checkIfMsgExists is 0
           errorAlert.append divAlert
-          $(".div-dropzone-alert").append btnAlert + errorMessage
+          $(".div-dropzone-alert").append "#{btnAlert}Attaching the file failed."
         return
 
       totaluploadprogress: (totalUploadProgress) ->

app/assets/javascripts/files_comment_button.js.coffee

+class @FilesCommentButton
+  COMMENT_BUTTON_CLASS = '.add-diff-note'
+  COMMENT_BUTTON_TEMPLATE = _.template '<button name="button" type="submit" class="btn <%- COMMENT_BUTTON_CLASS %> js-add-diff-note-button" title="Add a comment to this line"><i class="fa fa-comment-o"></i></button>'
+  LINE_HOLDER_CLASS = '.line_holder'
+  LINE_NUMBER_CLASS = 'diff-line-num'
+  LINE_CONTENT_CLASS = 'line_content'
+  UNFOLDABLE_LINE_CLASS = 'js-unfold'
+  EMPTY_CELL_CLASS = 'empty-cell'
+  OLD_LINE_CLASS = 'old_line'
+  NEW_CLASS = 'new'
+  LINE_COLUMN_CLASSES = ".#{LINE_NUMBER_CLASS}, .line_content"
+  TEXT_FILE_SELECTOR = '.text-file'
+  DEBOUNCE_TIMEOUT_DURATION = 100
+
+  constructor: (@filesContainerElement) ->
+    @VIEW_TYPE = $('input#view[type=hidden]').val()
+
+    debounce = _.debounce @render, DEBOUNCE_TIMEOUT_DURATION
+
+    $(document)
+      .on 'mouseover', LINE_COLUMN_CLASSES, debounce
+      .on 'mouseleave', LINE_COLUMN_CLASSES, @destroy
+
+  render: (e) =>
+    $currentTarget = $(e.currentTarget)
+    buttonParentElement = @getButtonParent $currentTarget
+    return unless @shouldRender e, buttonParentElement
+
+    textFileElement = @getTextFileElement $currentTarget
+    lineContentElement = @getLineContent $currentTarget
+
+    buttonParentElement.append @buildButton
+      noteableType: textFileElement.attr 'data-noteable-type'
+      noteableID: textFileElement.attr 'data-noteable-id'
+      commitID: textFileElement.attr 'data-commit-id'
+      noteType: lineContentElement.attr 'data-note-type'
+      position: lineContentElement.attr 'data-position'
+      lineType: lineContentElement.attr 'data-line-type'
+      discussionID: lineContentElement.attr 'data-discussion-id'
+      lineCode: lineContentElement.attr 'data-line-code'
+    return
+
+  destroy: (e) =>
+    return if @isMovingToSameType e
+    $(COMMENT_BUTTON_CLASS, @getButtonParent $(e.currentTarget)).remove()
+    return
+
+  buildButton: (buttonAttributes) ->
+    initializedButtonTemplate = COMMENT_BUTTON_TEMPLATE
+      COMMENT_BUTTON_CLASS: COMMENT_BUTTON_CLASS.substr 1
+    $(initializedButtonTemplate).attr
+      'data-noteable-type': buttonAttributes.noteableType
+      'data-noteable-id': buttonAttributes.noteableID
+      'data-commit-id': buttonAttributes.commitID
+      'data-note-type': buttonAttributes.noteType
+      'data-line-code': buttonAttributes.lineCode
+      'data-position': buttonAttributes.position
+      'data-discussion-id': buttonAttributes.discussionID
+      'data-line-type': buttonAttributes.lineType
+
+  getTextFileElement: (hoveredElement) ->
+    $(hoveredElement.closest TEXT_FILE_SELECTOR)
+
+  getLineContent: (hoveredElement) ->
+    return hoveredElement if hoveredElement.hasClass LINE_CONTENT_CLASS
+
+    $(".#{LINE_CONTENT_CLASS + @diffTypeClass hoveredElement}", hoveredElement.parent())
+
+  getButtonParent: (hoveredElement) ->
+    if @VIEW_TYPE is 'inline'
+      return hoveredElement if hoveredElement.hasClass OLD_LINE_CLASS
+
+      $(".#{OLD_LINE_CLASS}", hoveredElement.parent())
+    else
+      return hoveredElement if hoveredElement.hasClass LINE_NUMBER_CLASS
+
+      $(".#{LINE_NUMBER_CLASS + @diffTypeClass hoveredElement}", hoveredElement.parent())
+
+  diffTypeClass: (hoveredElement) ->
+    if hoveredElement.hasClass(NEW_CLASS) then '.new' else '.old'
+
+  isMovingToSameType: (e) ->
+    newButtonParent = @getButtonParent $(e.toElement)
+    return false unless newButtonParent
+    newButtonParent.is @getButtonParent $(e.currentTarget)
+
+  shouldRender: (e, buttonParentElement) ->
+    (not buttonParentElement.hasClass(EMPTY_CELL_CLASS) and \
+    not buttonParentElement.hasClass(UNFOLDABLE_LINE_CLASS) and \
+    $(COMMENT_BUTTON_CLASS, buttonParentElement).length is 0)
+
+$.fn.filesCommentButton = ->
+  return unless this and @parent().data('can-create-note')?
+
+  @each ->
+    unless $.data this, 'filesCommentButton'
+      $.data this, 'filesCommentButton', new FilesCommentButton $(this)

app/assets/javascripts/flash.js.coffee

 class @Flash
-  constructor: (message, type = 'alert')->
-    @flash = $(".flash-container")
-    @flash.html("")
+  hideFlash = -> $(@).fadeOut()
 
-    innerDiv = $('<div/>',
+  constructor: (message, type = 'alert', parent = null)->
+    if parent
+      @flashContainer = parent.find('.flash-container')
+    else
+      @flashContainer = $('.flash-container-page')
+
+    @flashContainer.html('')
+
+    flash = $('<div/>',
       class: "flash-#{type}"
     )
-    innerDiv.appendTo(".flash-container")
+    flash.on 'click', hideFlash
 
-    textDiv = $("<div/>",
-      class: "flash-text",
+    textDiv = $('<div/>',
+      class: 'flash-text',
       text: message
     )
-    textDiv.appendTo(innerDiv)
+    textDiv.appendTo(flash)
 
-    if @flash.parent().hasClass('content-wrapper')
+    if @flashContainer.parent().hasClass('content-wrapper')
       textDiv.addClass('container-fluid container-limited')
 
-    @flash.click -> $(@).fadeOut()
-    @flash.show()
+    flash.appendTo(@flashContainer)
+    @flashContainer.show()
 
-  pinTo: (selector) ->
-    @flash.detach().appendTo(selector)

app/assets/javascripts/gfm_auto_complete.js.coffee

@@ -190,7 +190,7 @@ GitLab.GfmAutoComplete =
       callbacks:
         beforeSave: (merges) ->
           sanitizeLabelTitle = (title)->
-            if /\w+\s+\w+/g.test(title)
+            if /[\w\?&]+\s+[\w\?&]+/g.test(title)
               "\"#{sanitize(title)}\""
             else
               sanitize(title)

app/assets/javascripts/gl_dropdown.js.coffee

@@ -56,6 +56,7 @@ class GitLabDropdownFilter
     return BLUR_KEYCODES.indexOf(keyCode) >= 0
 
   filter: (search_text) ->
+    @options.onFilter(search_text) if @options.onFilter
     data = @options.data()
 
     if data? and not @options.filterByText
@@ -195,6 +196,7 @@ class GitLabDropdown
       @filter = new GitLabDropdownFilter @filterInput,
         filterInputBlur: @filterInputBlur
         filterByText: @options.filterByText
+        onFilter: @options.onFilter
         remote: @options.filterRemote
         query: @options.data
         keys: searchFields
@@ -454,6 +456,8 @@ class GitLabDropdown
 
   rowClicked: (el) ->
     fieldName = @options.fieldName
+    isInput = $(@el).is('input')
+
     if @renderedData
       groupName = el.data('group')
       if groupName
@@ -464,10 +468,19 @@ class GitLabDropdown
         selectedObject = @renderedData[selectedIndex]
 
     value = if @options.id then @options.id(selectedObject, el) else selectedObject.id
-    field = @dropdown.parent().find("input[name='#{fieldName}'][value='#{value}']")
+
+    if isInput
+      field = $(@el)
+    else
+      field = @dropdown.parent().find("input[name='#{fieldName}'][value='#{value}']")
+
     if el.hasClass(ACTIVE_CLASS)
       el.removeClass(ACTIVE_CLASS)
-      field.remove()
+
+      if isInput
+        field.val('')
+      else
+        field.remove()
 
       # Toggle the dropdown label
       if @options.toggleLabel
@@ -488,7 +501,9 @@ class GitLabDropdown
     else
       if not @options.multiSelect or el.hasClass('dropdown-clear-active')
         @dropdown.find(".#{ACTIVE_CLASS}").removeClass ACTIVE_CLASS
-        @dropdown.parent().find("input[name='#{fieldName}']").remove()
+
+        unless isInput
+          @dropdown.parent().find("input[name='#{fieldName}']").remove()
 
       if !value?
         field.remove()
@@ -503,7 +518,9 @@ class GitLabDropdown
         if !field.length and fieldName
           @addInput(fieldName, value)
         else
-          field.val value
+          field
+            .val value
+            .trigger 'change'
 
       return selectedObject
 
@@ -530,7 +547,7 @@ class GitLabDropdown
     if $el.length
       e.preventDefault()
       e.stopImmediatePropagation()
-      $(selector, @dropdown)[0].click()
+      $el.first().trigger('click')
 
   addArrowKeyEvent: ->
     ARROW_KEY_CODES = [38, 40]

app/assets/javascripts/issuable.js.coffee

@@ -11,11 +11,11 @@ issuable_created = false
   initTemplates: ->
     Issuable.labelRow = _.template(
       '<% _.each(labels, function(label){ %>
-        <span class="label-row btn-group" role="group" aria-label="<%= _.escape(label.title) %>" style="color: <%= label.text_color %>;">
-          <a href="#" class="btn btn-transparent has-tooltip" style="background-color: <%= label.color %>;" title="<%= _.escape(label.description) %>" data-container="body">
-            <%= _.escape(label.title) %>
+        <span class="label-row btn-group" role="group" aria-label="<%- label.title %>" style="color: <%- label.text_color %>;">
+          <a href="#" class="btn btn-transparent has-tooltip" style="background-color: <%- label.color %>;" title="<%- label.description %>" data-container="body">
+            <%- label.title %>
           </a>
-          <button type="button" class="btn btn-transparent label-remove js-label-filter-remove" style="background-color: <%= label.color %>;" data-label="<%= _.escape(label.title) %>">
+          <button type="button" class="btn btn-transparent label-remove js-label-filter-remove" style="background-color: <%- label.color %>;" data-label="<%- label.title %>">
             <i class="fa fa-times"></i>
           </button>
         </span>
@@ -32,13 +32,11 @@ issuable_created = false
           $search = $('#issue_search')
           $form = $('.js-filter-form')
           $input = $("input[name='#{$search.attr('name')}']", $form)
-
           if $input.length is 0
             $form.append "<input type='hidden' name='#{$search.attr('name')}' value='#{_.escape($search.val())}'/>"
           else
             $input.val $search.val()
-
-          Issuable.filterResults $form
+          Issuable.filterResults $form if $search.val() isnt ''
         , 500)
 
   initLabelFilterRemove: ->

app/assets/javascripts/labels_select.js.coffee

@@ -32,9 +32,9 @@ class @LabelsSelect
       if issueUpdateURL
         labelHTMLTemplate = _.template(
             '<% _.each(labels, function(label){ %>
-            <a href="<%= ["",issueURLSplit[1], issueURLSplit[2],""].join("/") %>issues?label_name[]=<%= _.escape(label.title) %>">
-            <span class="label has-tooltip color-label" title="<%= _.escape(label.description) %>" style="background-color: <%= label.color %>; color: <%= label.text_color %>;">
-            <%= _.escape(label.title) %>
+            <a href="<%- ["",issueURLSplit[1], issueURLSplit[2],""].join("/") %>issues?label_name[]=<%- encodeURIComponent(label.title) %>">
+            <span class="label has-tooltip color-label" title="<%- label.description %>" style="background-color: <%- label.color %>; color: <%- label.text_color %>;">
+            <%- label.title %>
             </span>
             </a>
             <% }); %>'
@@ -261,7 +261,7 @@ class @LabelsSelect
             $a.attr('data-label-id', label.id)
 
           $a.addClass(selectedClass.join(' '))
-            .html("#{colorEl} #{_.escape(label.title)}")
+            .html("#{colorEl} #{label.title}")
 
           # Return generated html
           $li.html($a).prop('outerHTML')
@@ -288,7 +288,7 @@ class @LabelsSelect
         fieldName: $dropdown.data('field-name')
         id: (label) ->
           if $dropdown.hasClass("js-filter-submit") and not label.isAny?
-            _.escape label.title
+            label.title
           else
             label.id
 

app/assets/javascripts/lib/cropper.js.coffee

+#= require cropper

app/assets/javascripts/lib/utils/common_utils.js.coffee

@@ -5,12 +5,12 @@
 
   w.gl.utils.isInGroupsPage = ->
 
-    return $('body').data('page').split(':')[0] is 'groups'
+    return gl.utils.getPagePath() is 'groups'
 
 
   w.gl.utils.isInProjectPage = ->
 
-    return $('body').data('page').split(':')[0] is 'projects'
+    return gl.utils.getPagePath() is 'projects'
 
 
   w.gl.utils.getProjectSlug = ->
@@ -40,6 +40,9 @@
         e.stopImmediatePropagation()
         return false
 
+  gl.utils.getPagePath = ->
+    return $('body').data('page').split(':')[0]
+
 
   jQuery.timefor = (time, suffix, expiredLabel) ->
 

app/assets/javascripts/lib/utils/datetime_utility.js.coffee

@@ -2,10 +2,14 @@
 
   w.gl ?= {}
   w.gl.utils ?= {}
+  w.gl.utils.days = ['Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday', 'Sunday']
 
   w.gl.utils.formatDate = (datetime) ->
     dateFormat(datetime, 'mmm d, yyyy h:MMtt Z')
 
+  w.gl.utils.getDayName = (date) ->
+    this.days[date.getDay()]
+
   w.gl.utils.localTimeAgo = ($timeagoEls, setTimeago = true) ->
     $timeagoEls.each( ->
           $el = $(@)

app/assets/javascripts/lib/utils/text_utility.js.coffee

@@ -49,8 +49,9 @@
       insertText = "#{startChar}#{tag}#{selected}#{if wrap then tag else ' '}"
 
     if document.queryCommandSupported('insertText')
-      document.execCommand 'insertText', false, insertText
-    else
+      inserted = document.execCommand 'insertText', false, insertText
+
+    unless inserted
       try
         document.execCommand("ms-beginUndoUnit")
 

app/assets/javascripts/merge_request_tabs.js.coffee

@@ -153,17 +153,18 @@ class @MergeRequestTabs
 
   loadDiff: (source) ->
     return if @diffsLoaded
-
     @_get
       url: "#{source}.json" + @_location.search
       success: (data) =>
         $('#diffs').html data.html
         gl.utils.localTimeAgo($('.js-timeago', 'div#diffs'))
         $('#diffs .js-syntax-highlight').syntaxHighlight()
+        $('#diffs .diff-file').singleFileDiff()
         @expandViewContainer() if @diffViewType() is 'parallel'
         @diffsLoaded = true
         @scrollToElement("#diffs")
         @highlighSelectedLine()
+        @filesCommentButton = $('.files .diff-file').filesCommentButton()
 
         $(document)
           .off 'click', '.diff-line-num a'

app/assets/javascripts/milestone_select.js.coffee

@@ -24,14 +24,14 @@ class @MilestoneSelect
 
       if issueUpdateURL
         milestoneLinkTemplate = _.template(
-          '<a href="/<%= namespace %>/<%= path %>/milestones/<%= iid %>" class="bold has-tooltip" data-container="body" title="<%= remaining %>"><%= _.escape(title) %></a>'
+          '<a href="/<%- namespace %>/<%- path %>/milestones/<%- iid %>" class="bold has-tooltip" data-container="body" title="<%- remaining %>"><%- title %></a>'
         )
 
         milestoneLinkNoneTemplate = '<span class="no-value">None</span>'
 
         collapsedSidebarLabelTemplate = _.template(
-          '<span class="has-tooltip" data-container="body" title="<%= remaining %>" data-placement="left">
-            <%= _.escape(title) %>
+          '<span class="has-tooltip" data-container="body" title="<%- remaining %>" data-placement="left">
+            <%- title %>
           </span>'
         )
 

app/assets/javascripts/namespace_select.js.coffee

 class @NamespaceSelect
-  constructor: ->
-    namespaceFormatResult = (namespace) ->
-      markup = "<div class='namespace-result'>"
-      markup += "<span class='namespace-kind'>" + namespace.kind + "</span>"
-      markup += "<span class='namespace-path'>" + namespace.path + "</span>"
-      markup += "</div>"
-      markup
-
-    formatSelection = (namespace) ->
-      namespace.kind + ": " + namespace.path
-
-    $('.ajax-namespace-select').each (i, select) ->
-      $(select).select2
-        placeholder: "Search for namespace"
-        multiple: $(select).hasClass('multiselect')
-        minimumInputLength: 0
-        query: (query) ->
-          Api.namespaces query.term, (namespaces) ->
-            data = { results: namespaces }
-            query.callback(data)
-
-        dropdownCssClass: "ajax-namespace-dropdown"
-        formatResult: namespaceFormatResult
-        formatSelection: formatSelection
+  constructor: (opts) ->
+    {
+      @dropdown
+    } = opts
+
+    showAny = true
+    fieldName = 'namespace_id'
+
+    if @dropdown.attr 'data-field-name'
+     fieldName = @dropdown.data 'fieldName'
+
+    if @dropdown.attr 'data-show-any'
+      showAny = @dropdown.data 'showAny'
+
+    @dropdown.glDropdown(
+      filterable: true
+      selectable: true
+      filterRemote: true
+      search:
+        fields: ['path']
+      fieldName: fieldName
+      toggleLabel: (selected) ->
+        return if not selected.id? then selected.text else "#{selected.kind}: #{selected.path}"
+      data: (term, dataCallback) ->
+        Api.namespaces term, (namespaces) ->
+          if showAny
+            anyNamespace =
+              text: 'Any namespace'
+              id: null
+
+            namespaces.unshift(anyNamespace)
+            namespaces.splice 1, 0, 'divider'
+
+          dataCallback(namespaces)
+      text: (namespace) ->
+        return if not namespace.id? then namespace.text else "#{namespace.kind}: #{namespace.path}"
+      renderRow: @renderRow
+      clicked: @onSelectItem
+    )
+
+  onSelectItem: (item, el, e) =>
+    e.preventDefault()
+
+class @NamespaceSelects
+  constructor: (opts = {}) ->
+    {
+      @$dropdowns = $('.js-namespace-select')
+    } = opts
+
+    @$dropdowns.each (i, dropdown) ->
+      $dropdown = $(dropdown)
+
+      new NamespaceSelect(
+        dropdown: $dropdown
+      )

app/assets/javascripts/notes.js.coffee

@@ -100,13 +100,40 @@ class @Notes
     $('.note .js-task-list-container').taskList('disable')
     $(document).off 'tasklist:changed', '.note .js-task-list-container'
 
-  keydownNoteText: (e) ->
-    $this = $(this)
-    if $this.val() is '' and e.which is 38 and not isMetaKey e
-      myLastNote = $("li.note[data-author-id='#{gon.current_user_id}'][data-editable]:last")
-      if myLastNote.length
-        myLastNoteEditBtn = myLastNote.find('.js-note-edit')
-        myLastNoteEditBtn.trigger('click', [true, myLastNote])
+  keydownNoteText: (e) =>
+    return if isMetaKey e
+
+    $textarea = $(e.target)
+
+    # Edit previous note when UP arrow is hit
+    switch e.which
+      when 38
+        return unless $textarea.val() is ''
+
+        myLastNote = $("li.note[data-author-id='#{gon.current_user_id}'][data-editable]:last")
+        if myLastNote.length
+          myLastNoteEditBtn = myLastNote.find('.js-note-edit')
+          myLastNoteEditBtn.trigger('click', [true, myLastNote])
+
+      # Cancel creating diff note or editing any note when ESCAPE is hit
+      when 27
+        discussionNoteForm = $textarea.closest('.js-discussion-note-form')
+        if discussionNoteForm.length
+          if $textarea.val() isnt ''
+            return unless confirm('Are you sure you want to cancel creating this comment?')
+
+          @removeDiscussionNoteForm(discussionNoteForm)
+          return
+
+        editNote = $textarea.closest('.note')
+        if editNote.length
+          originalText = $textarea.closest('form').data('original-note')
+          newText = $textarea.val()
+          if originalText isnt newText
+            return unless confirm('Are you sure you want to cancel editing this comment?')
+
+          @removeNoteEditForm(editNote)
+
 
   isMetaKey = (e) ->
     (e.metaKey or e.ctrlKey or e.altKey or e.shiftKey)
@@ -167,8 +194,7 @@ class @Notes
   renderNote: (note) ->
     unless note.valid
       if note.award
-        flash = new Flash('You have already awarded this emoji!', 'alert')
-        flash.pinTo('.header-content')
+        new Flash('You have already awarded this emoji!', 'alert')
       return
 
     if note.award
@@ -213,12 +239,16 @@ class @Notes
 
     @note_ids.push(note.id)
     form = $("#new-discussion-note-form-#{note.discussion_id}")
+    if note.original_discussion_id? and form.length is 0
+      form = $("#new-discussion-note-form-#{note.original_discussion_id}")
     row = form.closest("tr")
     note_html = $(note.html)
     note_html.syntaxHighlight()
 
     # is this the first note of discussion?
     discussionContainer = $(".notes[data-discussion-id='" + note.discussion_id + "']")
+    if note.original_discussion_id? and discussionContainer.length is 0
+      discussionContainer = $(".notes[data-discussion-id='" + note.original_discussion_id + "']")
     if discussionContainer.length is 0
       # insert the note and the reply button after the temp row
       row.after note.discussion_html
@@ -291,8 +321,11 @@ class @Notes
     form.addClass "js-main-target-form"
 
     form.find("#note_line_code").remove()
+    form.find("#note_position").remove()
     form.find("#note_type").remove()
 
+    @parentTimeline = form.parents('.timeline')
+
   ###
   General note form setup.
 
@@ -308,10 +341,12 @@ class @Notes
 
     new Autosave textarea, [
       "Note"
-      form.find("#note_commit_id").val()
-      form.find("#note_line_code").val()
       form.find("#note_noteable_type").val()
       form.find("#note_noteable_id").val()
+      form.find("#note_commit_id").val()
+      form.find("#note_type").val()
+      form.find("#note_line_code").val()
+      form.find("#note_position").val()
     ]
 
   ###
@@ -323,8 +358,7 @@ class @Notes
     @renderNote(note)
 
   addNoteError: (xhr, note, status) =>
-    flash = new Flash('Your comment could not be submitted! Please check your network connection and try again.', 'alert')
-    flash.pinTo('.md-area')
+    new Flash('Your comment could not be submitted! Please check your network connection and try again.', 'alert', @parentTimeline)
 
   ###
   Called in response to the new note form being submitted
@@ -401,9 +435,12 @@ class @Notes
 
   Hides edit form and restores the original note text to the editor textarea.
   ###
-  cancelEdit: (e) ->
+  cancelEdit: (e) =>
     e.preventDefault()
-    note = $(this).closest(".note")
+    note = $(e.target).closest('.note')
+    @removeNoteEditForm(note)
+
+  removeNoteEditForm: (note) ->
     form = note.find(".current-note-edit-form")
     note.removeClass "is-editting"
     form.removeClass("current-note-edit-form")
@@ -482,10 +519,12 @@ class @Notes
   setupDiscussionNoteForm: (dataHolder, form) =>
     # setup note target
     form.attr 'id', "new-discussion-note-form-#{dataHolder.data("discussionId")}"
+    form.attr "data-line-code", dataHolder.data("lineCode")
     form.find("#note_type").val dataHolder.data("noteType")
     form.find("#line_type").val dataHolder.data("lineType")
     form.find("#note_commit_id").val dataHolder.data("commitId")
     form.find("#note_line_code").val dataHolder.data("lineCode")
+    form.find("#note_position").val dataHolder.attr("data-position")
     form.find("#note_noteable_type").val dataHolder.data("noteableType")
     form.find("#note_noteable_id").val dataHolder.data("noteableId")
     form.find('.js-note-discard')

app/assets/javascripts/profile/application.js.coffee

+#
+#= require_tree .

app/assets/javascripts/profile.js.coffee → app/assets/javascripts/profile/profile.js.coffee

@@ -78,3 +78,6 @@ $ ->
 
     if comment && comment.length > 1 && $title.val() == ''
       $title.val(comment[1]).change()
+
+  if gl.utils.getPagePath() == 'profiles'
+    new Profile()

app/assets/javascripts/projects_list.js.coffee

@@ -5,13 +5,12 @@
     this.initPagination()
 
   initSearch: ->
-    @timer = null
-    $(".projects-list-filter").on('keyup', ->
-      clearTimeout(@timer)
-      @timer = setTimeout(ProjectsList.filterResults, 500)
-    )
+    projectsListFilter = $('.projects-list-filter')
+    debounceFilter = _.debounce ProjectsList.filterResults, 500
+    projectsListFilter.on 'keyup', (e) ->
+      debounceFilter() if projectsListFilter.val() isnt ''
 
-  filterResults: =>
+  filterResults: ->
     $('.projects-list-holder').fadeTo(250, 0.5)
 
     form = null

app/assets/javascripts/protected_branch_select.js.coffee

+class @ProtectedBranchSelect
+  constructor: (currentProject) ->
+    $('.dropdown-footer').hide();
+    @dropdown = $('.js-protected-branch-select').glDropdown(
+      data: @getProtectedBranches
+      filterable: true
+      remote: false
+      search:
+        fields: ['title']
+      selectable: true
+      toggleLabel: (selected) -> if (selected and 'id' of selected) then selected.title else 'Protected Branch'
+      fieldName: 'protected_branch[name]'
+      text: (protected_branch) -> _.escape(protected_branch.title)
+      id: (protected_branch) -> _.escape(protected_branch.id)
+      onFilter: @toggleCreateNewButton
+      clicked: () -> $('.protect-branch-btn').attr('disabled', false)
+    )
+
+    $('.create-new-protected-branch').on 'click', (event) =>
+      # Refresh the dropdown's data, which ends up calling `getProtectedBranches`
+      @dropdown.data('glDropdown').remote.execute()
+      @dropdown.data('glDropdown').selectRowAtIndex(event, 0)
+
+  getProtectedBranches: (term, callback) =>
+    if @selectedBranch
+      callback(gon.open_branches.concat(@selectedBranch))
+    else
+      callback(gon.open_branches)
+
+  toggleCreateNewButton: (branchName) =>
+    @selectedBranch = { title: branchName, id: branchName, text: branchName }
+
+    if branchName is ''
+      $('.protected-branch-select-footer-list').addClass('hidden')
+      $('.dropdown-footer').hide();
+    else
+      $('.create-new-protected-branch').text("Create Protected Branch: #{branchName}")
+      $('.protected-branch-select-footer-list').removeClass('hidden')
+      $('.dropdown-footer').show();
+

app/assets/javascripts/protected_branches.js.coffee

@@ -11,7 +11,8 @@ $ ->
         dataType: "json"
         data:
           id: id
-          developers_can_push: checked
+          protected_branch:
+            developers_can_push: checked
 
         success: ->
           row = $(e.target)

app/assets/javascripts/shortcuts.js.coffee

@@ -2,9 +2,10 @@ class @Shortcuts
   constructor: (skipResetBindings) ->
     @enabledHelp = []
     Mousetrap.reset() if not skipResetBindings
-    Mousetrap.bind('?', @onToggleHelp)
-    Mousetrap.bind('s', Shortcuts.focusSearch)
-    Mousetrap.bind(['ctrl+shift+p', 'command+shift+p'], @toggleMarkdownPreview)
+    Mousetrap.bind '?', @onToggleHelp
+    Mousetrap.bind 's', Shortcuts.focusSearch
+    Mousetrap.bind 'f', (e) => @focusFilter e
+    Mousetrap.bind ['ctrl+shift+p', 'command+shift+p'], @toggleMarkdownPreview
     Mousetrap.bind('t', -> Turbolinks.visit(findFileURL)) if findFileURL?
 
   onToggleHelp: (e) =>
@@ -32,10 +33,16 @@ class @Shortcuts
           $('.js-more-help-button').remove()
     )
 
+  focusFilter: (e) ->
+    @filterInput ?= $('input[type=search]', '.nav-controls')
+    @filterInput.focus()
+    e.preventDefault()
+
   @focusSearch: (e) ->
     $('#search').focus()
     e.preventDefault()
 
+
 $(document).on 'click.more_help', '.js-more-help-button', (e) ->
   $(@).remove()
   $('.hidden-shortcut').show()

app/assets/javascripts/single_file_diff.js.coffee

+class @SingleFileDiff
+
+  WRAPPER = '<div class="diff-content diff-wrap-lines"></div>'
+  LOADING_HTML = '<i class="fa fa-spinner fa-spin"></i>'
+  ERROR_HTML = '<div class="nothing-here-block"><i class="fa fa-warning"></i> Could not load diff</div>'
+  COLLAPSED_HTML = '<div class="nothing-here-block diff-collapsed">This diff is collapsed. Click to expand it.</div>'
+
+  constructor: (@file) ->
+    @content = $('.diff-content', @file)
+    @diffForPath = @content.find('[data-diff-for-path]').data 'diff-for-path'
+    @isOpen = !@diffForPath
+
+    if @diffForPath
+      @collapsedContent = @content
+      @loadingContent = $(WRAPPER).addClass('loading').html(LOADING_HTML).hide()
+      @content = null
+      @collapsedContent.after(@loadingContent)
+    else
+      @collapsedContent = $(WRAPPER).html(COLLAPSED_HTML).hide()
+      @content.after(@collapsedContent)
+
+    @collapsedContent.on 'click', @toggleDiff
+
+    $('.file-title > a', @file).on 'click', @toggleDiff
+
+  toggleDiff: (e) =>
+    @isOpen = !@isOpen
+    if not @isOpen and not @hasError
+      @content.hide()
+      @collapsedContent.show()
+    else if @content
+      @collapsedContent.hide()
+      @content.show()
+    else
+      @getContentHTML()
+
+  getContentHTML: ->
+    @collapsedContent.hide()
+    @loadingContent.show()
+    $.get @diffForPath, (data) =>
+      @loadingContent.hide()
+      if data.html
+        @content = $(data.html)
+        @content.syntaxHighlight()
+      else
+        @hasError = true
+        @content = $(ERROR_HTML)
+      @collapsedContent.after(@content)
+    return
+
+$.fn.singleFileDiff = ->
+  return @each ->
+    if not $.data this, 'singleFileDiff'
+      $.data this, 'singleFileDiff', new SingleFileDiff this

app/assets/javascripts/u2f/authenticate.js.coffee

@@ -6,8 +6,20 @@
 class @U2FAuthenticate
   constructor: (@container, u2fParams) ->
     @appId = u2fParams.app_id
-    @challenges = u2fParams.challenges
-    @signRequests = u2fParams.sign_requests
+    @challenge = u2fParams.challenge
+
+    # The U2F Javascript API v1.1 requires a single challenge, with
+    # _no challenges per-request_. The U2F Javascript API v1.0 requires a
+    # challenge per-request, which is done by copying the single challenge
+    # into every request.
+    #
+    # In either case, we don't need the per-request challenges that the server
+    # has generated, so we can remove them.
+    #
+    # Note: The server library fixes this behaviour in (unreleased) version 1.0.0.
+    # This can be removed once we upgrade.
+    # https://github.com/castle/ruby-u2f/commit/103f428071a81cd3d5f80c2e77d522d5029946a4
+    @signRequests = u2fParams.sign_requests.map (request) -> _(request).omit('challenge')
 
   start: () =>
     if U2FUtil.isU2FSupported()
@@ -16,7 +28,7 @@ class @U2FAuthenticate
       @renderNotSupported()
 
   authenticate: () =>
-    u2f.sign(@appId, @challenges, @signRequests, (response) =>
+    u2f.sign(@appId, @challenge, @signRequests, (response) =>
       if response.errorCode
         error = new U2FError(response.errorCode)
         @renderError(error);

app/assets/javascripts/u2f/util.js.coffee

+class @U2FUtil
+  @isU2FSupported: ->
+    window.u2f

app/assets/javascripts/u2f/util.js.coffee.erb

-# Helper class for U2F (universal 2nd factor) device registration and authentication.
-
-class @U2FUtil
-  @isU2FSupported: ->
-    if @testMode
-      true
-    else
-      gon.u2f.browser_supports_u2f
-
-  @enableTestMode: ->
-    @testMode = true
-
-<% if Rails.env.test? %>
-U2FUtil.enableTestMode();
-<% end %>

app/assets/javascripts/users/calendar.js.coffee

@@ -87,14 +87,15 @@ class @Calendar
       .attr 'width', @daySize
       .attr 'height', @daySize
       .attr 'title', (stamp) =>
+        date = new Date(stamp.date)
         contribText = 'No contributions'
 
         if stamp.count > 0
           contribText = "#{stamp.count} contribution#{if stamp.count > 1 then 's' else ''}"
 
-        date = dateFormat(stamp.date, 'mmm d, yyyy')
+        dateText = dateFormat(date, 'mmm d, yyyy')
 
-        "#{contribText}<br />#{date}"
+        "#{contribText}<br />#{gl.utils.getDayName(date)} #{dateText}"
       .attr 'class', 'user-contrib-cell js-tooltip'
       .attr 'fill', (stamp) =>
         if stamp.count isnt 0

app/assets/javascripts/users_select.js.coffee

@@ -56,14 +56,18 @@ class @UsersSelect
               username: ''
               avatar: ''
           $value.html(assigneeTemplate(user))
+
+          $collapsedSidebar
+            .attr('title', user.name)
+            .tooltip('fixTitle')
+
           $collapsedSidebar.html(collapsedAssigneeTemplate(user))
 
 
       collapsedAssigneeTemplate = _.template(
         '<% if( avatar ) { %>
-        <a class="author_link" href="/u/<%= username %>">
-          <img width="24" class="avatar avatar-inline s24" alt="" src="<%= avatar %>">
-          <span class="author">Toni Boehm</span>
+        <a class="author_link" href="/u/<%- username %>">
+          <img width="24" class="avatar avatar-inline s24" alt="" src="<%- avatar %>">
         </a>
         <% } else { %>
         <i class="fa fa-user"></i>
@@ -72,13 +76,13 @@ class @UsersSelect
 
       assigneeTemplate = _.template(
         '<% if (username) { %>
-        <a class="author_link bold" href="/u/<%= username %>">
+        <a class="author_link bold" href="/u/<%- username %>">
           <% if( avatar ) { %>
-          <img width="32" class="avatar avatar-inline s32" alt="" src="<%= avatar %>">
+          <img width="32" class="avatar avatar-inline s32" alt="" src="<%- avatar %>">
           <% } %>
-          <span class="author"><%= name %></span>
+          <span class="author"><%- name %></span>
           <span class="username">
-            @<%= username %>
+            @<%- username %>
           </span>
         </a>
           <% } else { %>

app/assets/stylesheets/framework/avatar.scss

@@ -20,6 +20,7 @@
   }
 
   &.s16 { width: 16px; height: 16px; margin-right: 6px; }
+  &.s20 { width: 20px; height: 20px; margin-right: 7px; }
   &.s24 { width: 24px; height: 24px; margin-right: 8px; }
   &.s26 { width: 26px; height: 26px; margin-right: 8px; }
   &.s32 { width: 32px; height: 32px; margin-right: 10px; }

app/assets/stylesheets/framework/blank.scss

+.blank-state-welcome {
+  text-align: center;
+  border-bottom: 1px solid $border-color;
+
+  .blank-state-text {
+    margin-bottom: 0;
+  }
+}
+
 .blank-state {
   padding-top: 20px;
   padding-bottom: 20px;
@@ -6,7 +15,18 @@
 
 .blank-state-no-icon {
   padding-top: 40px;
-  padding-bottom: 40px;  
+  padding-bottom: 40px;
+}
+
+.blank-state-icon {
+  padding-bottom: 20px;
+  color: $gray-darkest;
+  font-size: 56px;
+
+  path,
+  polygon {
+    fill: currentColor;
+  }
 }
 
 .blank-state-title {
@@ -20,4 +40,12 @@
   margin-top: 0;
   margin-bottom: $gl-padding;
   font-size: 15px;
+
+  > strong {
+    font-weight: 600;
+  }
+}
+
+.blank-state-welcome-title {
+  font-size: 24px;
 }

app/assets/stylesheets/framework/blocks.scss

@@ -16,6 +16,15 @@
   font-weight: normal;
   font-size: 16px;
   line-height: 36px;
+
+  &.diff-collapsed {
+    padding: 5px;
+    cursor: pointer;
+
+    &:hover {
+      background-color: $row-hover;
+    }
+  }
 }
 
 .row-content-block {

app/assets/stylesheets/framework/buttons.scss

@@ -281,3 +281,21 @@
     color: $gl-icon-color;
   }
 }
+
+.clone-dropdown-btn a {
+  color: $dropdown-link-color;
+  &:hover {
+    text-decoration: none;
+  }
+}
+
+.btn-static {
+  background-color: $background-color !important;
+  border: 1px solid lightgrey;
+  cursor: default;
+  &:active {
+    -moz-box-shadow: inset 0 0 0 white;
+    -webkit-box-shadow: inset 0 0 0 white;
+    box-shadow: inset 0 0 0 white;
+  }
+}

app/assets/stylesheets/framework/common.scss

@@ -270,21 +270,6 @@ table {
   }
 }
 
-.dashboard-intro-icon {
-  float: left;
-  text-align: center;
-  font-size: 32px;
-  color: #aaa;
-  width: 60px;
-}
-
-.dashboard-intro-text {
-  display: inline-block;
-  margin-left: -60px;
-  padding-left: 60px;
-  width: 100%;
-}
-
 .btn-sign-in {
   text-shadow: none;
 

app/assets/stylesheets/framework/dropdowns.scss

@@ -23,6 +23,9 @@
   .dropdown-menu,
   .dropdown-menu-nav {
     display: block;
+    @media (max-width: $screen-xs-max) {
+      width: 100%;
+    }
   }
 
   .dropdown-menu-toggle {
@@ -65,6 +68,10 @@
       color: $dropdown-toggle-hover-icon-color;
     }
   }
+
+  &.large {
+    width: 200px;
+  }
 }
 
 .dropdown-menu,

app/assets/stylesheets/framework/files.scss

@@ -50,7 +50,7 @@
     }
 
     a:not(.btn) {
-      color: $gl-dark-link-color;
+      color: $gl-text-color;
     }
 
     .left-options {

app/assets/stylesheets/framework/flash.scss

 .flash-container {
   cursor: pointer;
   margin: 0;
+  margin-bottom: $gl-padding;
   font-size: 14px;
-  width: 100%;
   z-index: 100;
 
   .flash-notice {
@@ -18,9 +18,27 @@
   }
 
   .flash-notice, .flash-alert {
-    .container-fluid.flash-text {
+    border-radius: $border-radius-default;
+
+    .container-fluid.container-limited.flash-text {
       background: transparent;
     }
   }
+
+  &.flash-container-page {
+    margin-bottom: 0;
+
+    .flash-notice, .flash-alert {
+      border-radius: 0;
+    }
+  }
+}
+
+@media (max-width: $screen-md-min) {
+  ul.notes {
+    .flash-container.timeline-content {
+      margin-left: 0;
+    }
+  }
 }
 

app/assets/stylesheets/framework/gitlab-theme.scss

@@ -11,7 +11,6 @@
     .toggle-nav-collapse,
     .pin-nav-btn {
       color: $color-light;
-      background: $color;
 
       &:hover {
         color: $white-light;
@@ -20,17 +19,6 @@
 
     .sidebar-wrapper {
       background: $color-darker;
-
-      .sidebar-user {
-        background: $color-darker;
-        color: $color-light;
-
-        &:hover {
-          background-color: $color-dark;
-          color: $white-light;
-          text-decoration: none;
-        }
-      }
     }
 
     .nav-sidebar li {

app/assets/stylesheets/framework/lists.scss

@@ -137,6 +137,15 @@ ul.content-list {
       padding-top: 1px;
       float: right;
 
+      > .control-text {
+        margin-right: $gl-padding-top;
+        line-height: 40px;
+
+        &:last-child {
+          margin-right: 0;
+        }
+      }
+
       > .btn,
       > .btn-group {
         margin-right: $gl-padding-top;
@@ -166,6 +175,12 @@ ul.content-list {
 
 .panel > .content-list > li {
   padding: $gl-padding-top $gl-padding;
+
+  &.commit {
+    @media (min-width: $screen-sm-min) {
+      padding-left: 46px + $gl-padding;
+    }
+  }
 }
 
 ul.controls {

app/assets/stylesheets/framework/nav.scss

@@ -77,10 +77,10 @@
 
   &.sub-nav {
     text-align: center;
-    background-color: $background-color;
+    background-color: $dark-background-color;
 
     .container-fluid {
-      background-color: $background-color;
+      background-color: $dark-background-color;
       margin-bottom: 0;
     }
 
@@ -134,6 +134,11 @@
     margin-bottom: 0;
     border-bottom: none;
 
+    &.wide {
+      width: 100%;
+      display: block;
+    }
+
     li a {
       padding: 16px 10px 11px;
     }
@@ -164,6 +169,7 @@
     > .btn {
       margin-right: $gl-padding-top;
       display: inline-block;
+      vertical-align: top;
 
       &:last-child {
         margin-right: 0;

app/assets/stylesheets/framework/sidebar.scss

@@ -3,6 +3,12 @@
   padding-bottom: 25px;
   transition: padding $sidebar-transition-duration;
 
+  &.page-sidebar-pinned {
+    .sidebar-wrapper {
+      @include box-shadow(none);
+    }
+  }
+
   .sidebar-wrapper {
     position: fixed;
     top: 0;
@@ -11,6 +17,7 @@
     height: 100%;
     overflow: hidden;
     transition: width $sidebar-transition-duration;
+    @include box-shadow(2px 0 16px 0 $black-transparent);
   }
 }
 
@@ -40,34 +47,14 @@
   }
 }
 
-.sidebar-user {
-  padding: 15px;
-  position: absolute;
-  left: 0;
-  bottom: 0;
-  width: $sidebar_width;
-  overflow: hidden;
-  font-size: 16px;
-  line-height: 36px;
-  transition: width $sidebar-transition-duration, padding $sidebar-transition-duration;
-
-  @media (min-width: $sidebar-breakpoint) {
-    bottom: 50px;
-  }
-}
-
 .nav-sidebar {
   position: absolute;
   top: 50px;
-  bottom: 65px;
+  bottom: 0;
   width: $sidebar_width;
   overflow-y: auto;
   overflow-x: hidden;
 
-  @media (min-width: $sidebar-breakpoint) {
-    bottom: 115px;
-  }
-
   &.navbar-collapse {
     padding: 0 !important;
   }
@@ -85,7 +72,7 @@
     }
 
     a {
-      padding: 7px 15px 7px 12px;
+      padding: 7px $gl-sidebar-padding;
       font-size: $gl-font-size;
       line-height: 24px;
       display: block;
@@ -117,7 +104,7 @@
   }
 }
 
-.toggle-nav-collapse {
+.sidebar-action-buttons {
   width: $sidebar_width;
   position: absolute;
   top: 0;
@@ -126,12 +113,37 @@
   padding: 5px 0;
   font-size: 18px;
   line-height: 30px;
+
+  .toggle-nav-collapse {
+    left: 0;
+  }
+
+  .pin-nav-btn {
+    right: 0;
+    display: none;
+
+    @media (min-width: $sidebar-breakpoint) {
+      display: block;
+    }
+
+    .fa {
+      transition: transform .15s;
+    }
+
+    &.is-active {
+      .fa {
+        transform: rotate(90deg);
+      }
+    }
+  }
 }
 
 .nav-header-btn {
-  padding: 10px 5px;
+  padding: 10px $gl-sidebar-padding;
   color: inherit;
   transition-duration: .3s;
+  position: absolute;
+  top: 0;
 
   &:hover,
   &:focus {
@@ -140,30 +152,6 @@
   }
 }
 
-.pin-nav-btn {
-  display: none;
-  position: absolute;
-  left: 0;
-  bottom: 0;
-  height: 50px;
-  width: $sidebar_width;
-  line-height: 30px;
-
-  @media (min-width: $sidebar-breakpoint) {
-    display: block;
-  }
-
-  .fa {
-    transition: transform .15s;
-  }
-
-  &.is-active {
-    .fa {
-      transform: rotate(90deg);
-    }
-  }
-}
-
 .page-sidebar-collapsed {
   padding-left: 0;
 

app/assets/stylesheets/framework/variables.scss

@@ -12,10 +12,12 @@ $sidebar-breakpoint: 1024px;
 /*
  * UI elements
  */
-$border-color:       #e5e5e5;
-$focus-border-color: #3aabf0;
-$table-border-color: #f0f0f0;
-$background-color:   #fafafa;
+$border-color:          #e5e5e5;
+$focus-border-color:    #3aabf0;
+$table-border-color:    #f0f0f0;
+$background-color:      #fafafa;
+$dark-background-color: #f7f7f7;
+$table-text-gray:       #8f8f8f;
 
 /*
  * Text
@@ -62,6 +64,7 @@ $gl-btn-padding: 10px;
 $gl-input-padding: 10px;
 $gl-vert-padding: 6px;
 $gl-padding-top: 10px;
+$gl-sidebar-padding: 22px;
 
 /*
  * Misc
@@ -153,9 +156,6 @@ $warning-message-bg: #fbf2d9;
 $warning-message-color: #9e8e60;
 $warning-message-border: #f0e2bb;
 
-/* header */
-$light-grey-header: #faf9f9;
-
 /* tanuki logo colors */
 $tanuki-red: #e24329;
 $tanuki-orange: #fc6d26;

app/assets/stylesheets/pages/admin.scss

@@ -71,3 +71,30 @@
   @extend .broadcast-message;
   margin-bottom: 20px;
 }
+
+
+// Users List
+
+.users-list {
+  .user-row {
+    display: -webkit-flex;
+    display: -ms-flexbox;
+    display: flex;
+  }
+
+  .user-details {
+    flex: 1 1 auto;
+  }
+
+  .user-name {
+    display: inline-block;
+    font-weight: 600;
+  }
+
+  .dropdown {
+    .btn-block {
+      margin-bottom: 0;
+      line-height: inherit;
+    }
+  }
+}

app/assets/stylesheets/pages/builds.scss

@@ -83,14 +83,6 @@
   }
 }
 
-table.builds {
-  .build-link {
-    a {
-      color: $gl-dark-link-color;
-    }
-  }
-}
-
 .build-trace {
   background: $ci-output-bg;
   color: $ci-text-color;

app/assets/stylesheets/pages/commits.scss

@@ -61,7 +61,7 @@
     font-size: 0;
   }
 
-  .btn-transparent {
+  .btn-clipboard, .btn-transparent {
     padding-left: 0;
     padding-right: 0;
   }

app/assets/stylesheets/pages/diff.scss

@@ -434,13 +434,3 @@
     }
   }
 }
-
-.discussion {
-  .diff-content {
-    .diff-line-num {
-      &:before {
-        content: attr(data-linenumber);
-      }
-    }
-  }
-}

app/assets/stylesheets/pages/groups.scss

@@ -40,6 +40,12 @@
   }
 }
 
+.ldap-group-links {
+  .form-actions {
+    margin-bottom: $gl-padding;
+  }
+}
+
 .groups-cover-block {
   .container-fluid {
     position: relative;

app/assets/stylesheets/pages/issues.scss

@@ -63,8 +63,8 @@ form.edit-issue {
 .merge-request,
 .issue {
   &.today {
-    background: #efe;
-    border-color: #cec;
+    background: #f8feef;
+    border-color: #e1e8d5;
   }
 
   &.closed {

app/assets/stylesheets/pages/labels.scss

@@ -162,9 +162,15 @@
 }
 
 .filtered-labels {
+  font-size: 0;
+  padding: 12px 16px;
+
   .label-row {
+    margin-top: 4px;
+    margin-bottom: 4px;
+
     &:not(:last-child) {
-      margin-right: 5px;
+      margin-right: 8px;
     }
   }
 

app/assets/stylesheets/pages/merge_requests.scss

@@ -73,11 +73,14 @@
       color: #888;
     }
 
-    &.ci-pending,
-    &.ci-running {
+    &.ci-pending {
       color: $gl-warning;
     }
 
+    &.ci-running {
+      color: $blue-normal;
+    }
+
     &.ci-failed,
     &.ci-error {
       color: $gl-danger;
@@ -167,7 +170,8 @@
 
   .commit {
     margin: 0;
-    padding: 2px 0;
+    padding-top: 2px;
+    padding-bottom: 2px;
     list-style: none;
     &:hover {
       background: none;

app/assets/stylesheets/pages/pipelines.scss

 .pipelines {
   .stage {
-    max-width: 100px;
+    max-width: 80px;
+    width: 80px;
     overflow: hidden;
     text-overflow: ellipsis;
     white-space: nowrap;
   }
 
-  .duration, .finished_at {
-    margin: 4px 0;
-  }
-
   .commit-title {
     margin: 0;
   }
@@ -22,3 +19,156 @@
     margin: 4px;
   }
 }
+
+.content-list {
+
+  &.pipelines,
+  &.builds-content-list {
+    width: 100%;
+    overflow: auto;
+  }
+}
+
+.table.builds {
+  min-width: 1100px;
+
+  tr {
+    th {
+      padding: 16px;
+      border: none;
+    }
+  }
+
+  tbody {
+    border-top-width: 1px;
+  }
+
+  .commit-link {
+
+    a:hover {
+      text-decoration: none;
+    }
+  }
+
+  .branch-commit {
+
+    .branch-name {
+      margin-left: 8px;
+      font-weight: bold;
+      max-width: 180px;
+      overflow: hidden;
+      display: inline-block;
+      white-space: nowrap;
+      vertical-align: top;
+      text-overflow: ellipsis;
+    }
+
+    svg {
+      margin: 0 6px;
+      height: 14px;
+      width: auto;
+      vertical-align: middle;
+    }
+
+    .commit-id {
+      color: $gl-link-color;
+      margin-right: 8px;
+    }
+
+    .commit-title {
+      margin-top: 4px;
+      max-width: 320px;
+      overflow: hidden;
+      white-space: nowrap;
+      text-overflow: ellipsis;
+    }
+
+    .avatar {
+      margin-left: 0;
+    }
+
+    .label {
+      margin-right: 4px;
+    }
+
+    .label-container {
+      font-size: 0;
+
+      .label {
+        margin-top: 5px;
+      }
+    }
+  }
+
+  .duration,
+  .finished-at {
+    color: $table-text-gray;
+    margin: 4px 0;
+
+    .fa {
+      font-size: 12px;
+    }
+
+    svg {
+      height: 12px;
+      width: auto;
+      vertical-align: middle;
+    }
+
+    .fa,
+    svg {
+      margin-right: 5px;
+    }
+  }
+
+  .pipeline-actions {
+
+    .btn {
+      margin: 0;
+      color: $table-text-gray;
+    }
+
+    .cancel-retry-btns {
+      vertical-align: middle;
+
+      .btn:not(:first-child) {
+        margin-left: 8px;
+      }
+    }
+
+    .dropdown-toggle,
+    .dropdown-menu {
+      color: $table-text-gray;
+
+      .fa {
+        color: $table-text-gray;
+        margin-right: 6px;
+        font-size: 14px;
+      }
+    }
+
+    .btn-remove {
+      color: $white-light;
+    }
+
+    .btn-group {
+      &.open {
+        .btn-default {
+          background-color: $white-normal;
+          border-color: $border-white-normal;
+        }
+      }
+    }
+  }
+
+  .build-link {
+
+    a {
+      color: $gl-dark-link-color;
+    }
+  }
+
+  .btn-group.open .dropdown-toggle {
+    box-shadow: none;
+  }
+}

app/assets/stylesheets/pages/projects.scss

@@ -64,86 +64,49 @@
 }
 
 .project-home-panel {
-  background: $white-light;
-  text-align: left;
-  padding: 24px 0;
+  padding-top: 24px;
+  padding-bottom: 24px;
 
-  .container-fluid {
-    position: relative;
-
-    @media (min-width: $screen-lg-min) {
-      .row {
-        display: flex;
-        -ms-flex-align: center;
-        -webkit-align-items: center;
-        -webkit-box-align: center;
-      }
-    }
+  @media (min-width: $screen-sm-min) {
+    border-bottom: 1px solid $border-color;
   }
 
-  .cover-controls {
-    .project-settings-dropdown {
-      margin-left: 10px;
-      display: inline-block;
+  .project-avatar {
+    float: none;
+    margin-left: auto;
+    margin-right: auto;
 
-      .dropdown-menu {
-        left: auto;
-        width: auto;
-        right: 0;
-        max-width: 240px;
-      }
+    &.identicon {
+      border-radius: 50%;
     }
   }
 
-  .cover-title {
-    margin-bottom: 0;
-  }
-
-  .project-image-container {
-    @include make-sm-column(1);
-    max-width: 86px;
-    min-width: 86px;
-    padding-right: 0;
-
-    @media (max-width: $screen-md-max) {
-      padding-left: 0;
-      margin: 0 0 10px;
-      max-width: none;
-      min-width: none;
+  .project-title {
+    margin-top: 10px;
+    margin-bottom: 10px;
+    font-size: 24px;
+    font-weight: 400;
+    line-height: 1;
 
-      .avatar.s70 {
-        margin: auto;
-      }
+    .fa {
+      margin-left: 2px;
+      font-size: 12px;
+      vertical-align: middle;
     }
   }
 
-  .project-info {
-    @include make-sm-column(10);
+  .project-home-desc {
+    margin-left: auto;
+    margin-right: auto;
+    margin-bottom: 15px;
+    max-width: 480px;
 
-    h1 {
-      font-size: 24px;
-      font-weight: normal;
-      margin: 0;
+    > p {
+      margin-bottom: 0;
     }
-
-    .project-home-desc {
-      p {
-        margin: 0;
-      }
-    }
-  }
-
-  .identicon {
-    float: left;
-    @include border-radius(50%);
-  }
-
-  .avatar {
-    float: none;
   }
 
   .notifications-btn {
-
     .fa-bell,
     .fa-spinner {
       margin-right: 6px;
@@ -153,127 +116,106 @@
       margin-left: 6px;
     }
   }
+}
 
-  .project-repo-buttons {
-    font-size: 0;
-
-    .btn {
-      @include btn-gray;
-      padding: 3px 10px;
-      text-transform: none;
-      background-color: $background-color;
+.project-repo-buttons {
+  font-size: 0;
 
-      .fa {
-        color: $layout-link-gray;
-      }
+  .btn {
+    @include btn-gray;
+    padding: 3px 10px;
 
-      .fa-caret-down {
-        margin-left: 3px;
-      }
+    .fa {
+      color: $layout-link-gray;
     }
 
-    form {
-      margin-left: 10px;
+    .fa-caret-down {
+      margin-left: 3px;
     }
+  }
 
-    .count-buttons {
-      display: inline-block;
-      vertical-align: top;
-      margin-top: 16px;
-    }
+  .project-repo-btn-group,
+  .notification-dropdown {
+    margin-left: 10px;
+  }
 
-    .project-clone-holder {
-      display: inline-block;
-      margin-top: 16px;
+  .count-buttons {
+    display: inline-block;
+    vertical-align: top;
+  }
 
-      input {
-        height: 29px;
-      }
+  .project-clone-holder {
+    display: inline-block;
+
+    input {
+      height: 29px;
     }
+  }
 
-    .count-with-arrow {
-      display: inline-block;
-      position: relative;
-      margin-left: 4px;
-
-      .arrow {
-        &:before {
-          content: '';
-          display: inline-block;
-          position: absolute;
-          width: 0;
-          height: 0;
-          border-color: transparent;
-          border-style: solid;
-          top: 50%;
-          left: 0;
-          margin-top: -6px;
-          border-width: 7px 5px 7px 0;
-          border-right-color: #dce0e5;
-        }
+  .count-with-arrow {
+    display: inline-block;
+    position: relative;
+    margin-left: 4px;
 
-        &:after {
-          content: '';
-          position: absolute;
-          width: 0;
-          height: 0;
-          border-color: transparent;
-          border-style: solid;
-          top: 50%;
-          left: 1px;
-          margin-top: -9px;
-          border-width: 10px 7px 10px 0;
-          border-right-color: #fff;
-        }
-      }
-      .count {
-        @include btn-gray;
+    .arrow {
+      &:before {
+        content: '';
         display: inline-block;
-        background: white;
-        border-radius: 2px;
-        border-width: 1px;
+        position: absolute;
+        width: 0;
+        height: 0;
+        border-color: transparent;
         border-style: solid;
-        font-size: 13px;
-        font-weight: 600;
-        line-height: 13px;
-        padding: $gl-vert-padding $gl-padding;
-        letter-spacing: .4px;
-        padding: 7px 14px;
-        text-align: center;
-        vertical-align: middle;
-        touch-action: manipulation;
-        cursor: pointer;
-        background-image: none;
-        white-space: nowrap;
-        margin: 0 10px 0 4px;
-
-        a {
-          color: inherit;
-        }
-
-        &:hover {
-          background: #fff;
-        }
+        top: 50%;
+        left: 0;
+        margin-top: -6px;
+        border-width: 7px 5px 7px 0;
+        border-right-color: #dce0e5;
+        pointer-events: none;
       }
-    }
-  }
-
-  .project-right-buttons {
-    position: absolute;
-    right: 16px;
-    bottom: 0;
 
-    @media (max-width: $screen-md-max) {
-      top: 0;
+      &:after {
+        content: '';
+        position: absolute;
+        width: 0;
+        height: 0;
+        border-color: transparent;
+        border-style: solid;
+        top: 50%;
+        left: 1px;
+        margin-top: -9px;
+        border-width: 10px 7px 10px 0;
+        border-right-color: #fff;
+        pointer-events: none;
+      }
     }
-  }
-
-  @media (max-width: $screen-md-max) {
-    text-align: center;
+    .count {
+      @include btn-gray;
+      display: inline-block;
+      background: white;
+      border-radius: 2px;
+      border-width: 1px;
+      border-style: solid;
+      font-size: 13px;
+      font-weight: 600;
+      line-height: 13px;
+      padding: $gl-vert-padding $gl-padding;
+      letter-spacing: .4px;
+      padding: 7px 14px;
+      text-align: center;
+      vertical-align: middle;
+      touch-action: manipulation;
+      background-image: none;
+      white-space: nowrap;
+      margin: 0 10px 0 4px;
+
+      a {
+        color: inherit;
+      }
 
-    .project-info,
-    .project-image-container {
-      width: 100%;
+      &:hover {
+        background: #fff;
+      }
     }
   }
 }
@@ -398,59 +340,72 @@ a.deploy-project-label {
 
 .project-import {
   .form-group {
-    margin-bottom: 0;
+    margin-bottom: 5px;
   }
+
   .import-buttons {
     padding-left: 0;
     display: -webkit-flex;
     display: flex;
     -webkit-flex-wrap: wrap;
     flex-wrap: wrap;
+
     .btn {
-      margin-right: 10px;
-      padding: 8px 12px;
+      margin: 0 10px 10px 0;
+      padding: 8px;
     }
-    &> div {
-      margin-bottom: 14px;
+
+    > div {
       padding-left: 0;
+
       &:last-child {
         margin-bottom: 0;
+
+        .btn {
+          margin-right: 0;
+        }
       }
     }
   }
 }
 
 .project-stats {
-  margin-top: $gl-padding;
-  margin-bottom: 0;
-  padding: 0;
-  background-color: $white-light;
   font-size: 0;
+  border-bottom: 1px solid $border-color;
 
-  ul.nav {
-    display: inline-block;
+  .nav {
+    padding-top: 12px;
+    padding-bottom: 12px;
   }
 
-  .nav li {
+  .nav > li {
     display: inline-block;
-    margin: 16px 0;
-    margin-right: 16px;
+
+    &:not(:last-child) {
+      margin-right: $gl-padding;
+    }
+
+    &.project-repo-buttons-right {
+      margin-top: 10px;
+
+      @media (min-width: $screen-md-min) {
+        float: right;
+        margin-top: 0;
+      }
+    }
   }
 
   .nav > li > a {
+    padding: 0;
     background-color: transparent;
-    padding: 5px 10px;
     font-size: 15px;
+    line-height: 29px;
     color: $notes-light-color;
-  }
 
-  li {
-    display: inline;
-  }
-
-  a {
-    float: left;
-    font-size: 17px;
+    &:hover,
+    &:focus {
+      color: darken($notes-light-color, 15%);
+    }
   }
 
   li.missing {
@@ -458,6 +413,8 @@ a.deploy-project-label {
     border-radius: $border-radius-default;
 
     a {
+      padding-left: 10px;
+      padding-right: 10px;
       color: $notes-light-color;
       display: block;
     }
@@ -466,10 +423,6 @@ a.deploy-project-label {
       background-color: $gray-normal;
     }
   }
-
-  &.row-content-block.second-block {
-    margin-top: 0;
-  }
 }
 
 pre.light-well {
@@ -557,8 +510,32 @@ pre.light-well {
 }
 
 .project-last-commit {
+  @media (min-width: $screen-sm-min) {
+    margin-top: $gl-padding;
+  }
+
+  &.container-fluid {
+    padding-top: 12px;
+    padding-bottom: 12px;
+    background-color: $background-color;
+    border: 1px solid $border-color;
+    border-right-width: 0;
+    border-left-width: 0;
+
+    @media (min-width: $screen-sm-min) {
+      border-right-width: 1px;
+      border-left-width: 1px;
+    }
+  }
+
+  &.container-limited {
+    @media (min-width: 1281px) {
+      border-radius: $border-radius-base;
+    }
+  }
+
   .ci-status {
-    margin-right: 16px;
+    margin-right: $gl-padding;
   }
 
   .commit-row-message {
@@ -566,19 +543,12 @@ pre.light-well {
   }
 
   .commit_short_id {
-    margin: 0 5px;
+    margin-right: 5px;
     color: $gl-link-color;
     font-weight: 600;
   }
 
   .commit-author-link {
-    margin-left: 7px;
-    text-decoration: none;
-    .avatar {
-      float: none;
-      margin-right: 4px;
-    }
-
     .commit-author-name {
       font-weight: 600;
     }
@@ -601,15 +571,10 @@ pre.light-well {
 }
 
 .git-clone-holder {
-  width: 498px;
+  width: 380px;
 
   .btn-clipboard {
     border: 1px solid $border-color;
-    padding: 6px $gl-padding;
-  }
-
-  .project-home-dropdown + & {
-    margin-right: 45px;
   }
 
   .clone-options {
@@ -678,3 +643,9 @@ pre.light-well {
     width: 300px;
   }
 }
+
+.compare-form-group {
+  .dropdown-menu {
+    width: 300px;
+  }
+}

app/assets/stylesheets/pages/search.scss

@@ -185,7 +185,7 @@
     padding-right: $gl-padding + 15px;
   }
 
-  .btn-search {
+  .btn-search, .btn-new {
     width: 100%;
     margin-top: 5px;
 
@@ -208,7 +208,7 @@
     margin-top: 5px;
 
     @media (min-width: $screen-sm-min) {
-      width: 160px;
+      width: 180px;
       margin-top: 0;
     }
   }

app/assets/stylesheets/pages/status.scss

@@ -32,11 +32,15 @@
       border-color: $gl-gray;
     }
 
-    &.ci-pending,
-    &.ci-running {
+    &.ci-pending {
       color: $gl-warning;
       border-color: $gl-warning;
     }
+
+    &.ci-running {
+      color: $blue-normal;
+      border-color: $blue-normal;
+    }
   }
 
   .ci-status-icon-success {
@@ -45,10 +49,12 @@
   .ci-status-icon-failed {
     color: $gl-danger;
   }
-  .ci-status-icon-running,
   .ci-status-icon-pending {
     color: $gl-warning;
   }
+  .ci-status-icon-running {
+    color: $blue-normal;
+  }
   .ci-status-icon-canceled,
   .ci-status-icon-disabled,
   .ci-status-icon-not-found,

app/assets/stylesheets/pages/tree.scss

@@ -23,12 +23,11 @@
       }
 
       &:hover {
-        cursor: pointer;
-
         td {
           background-color: $row-hover;
           border-top: 1px solid $row-hover-border;
           border-bottom: 1px solid $row-hover-border;
+          cursor: pointer;
         }
       }
 

app/controllers/admin/application_settings_controller.rb

@@ -87,6 +87,7 @@ class Admin::ApplicationSettingsController < Admin::ApplicationController
       :version_check_enabled,
       :admin_notification_email,
       :user_oauth_applications,
+      :user_default_external,
       :shared_runners_enabled,
       :shared_runners_text,
       :max_artifacts_size,
@@ -110,6 +111,7 @@ class Admin::ApplicationSettingsController < Admin::ApplicationController
       :send_user_confirmation_email,
       :container_registry_token_expire_delay,
       :repository_storage,
+      :enabled_git_access_protocol,
       restricted_visibility_levels: [],
       import_sources: [],
       disabled_oauth_sign_in_sources: []

app/controllers/admin/projects_controller.rb

@@ -5,11 +5,12 @@ class Admin::ProjectsController < Admin::ApplicationController
   def index
     @projects = Project.all
     @projects = @projects.in_namespace(params[:namespace_id]) if params[:namespace_id].present?
-    @projects = @projects.where("projects.visibility_level IN (?)", params[:visibility_levels]) if params[:visibility_levels].present?
+    @projects = @projects.where(visibility_level: params[:visibility_level]) if params[:visibility_level].present?
     @projects = @projects.with_push if params[:with_push].present?
     @projects = @projects.abandoned if params[:abandoned].present?
     @projects = @projects.where(last_repository_check_failed: true) if params[:last_repository_check_failed].present?
-    @projects = @projects.non_archived unless params[:with_archived].present?
+    @projects = @projects.non_archived unless params[:archived].present?
+    @projects = @projects.personal(current_user) if params[:personal].present?
     @projects = @projects.search(params[:name]) if params[:name].present?
     @projects = @projects.sort(@sort = params[:sort])
     @projects = @projects.includes(:namespace).order("namespaces.path, projects.name ASC").page(params[:page])

app/controllers/application_controller.rb

@@ -344,10 +344,6 @@ class ApplicationController < ActionController::Base
     session[:skip_tfa] && session[:skip_tfa] > Time.current
   end
 
-  def browser_supports_u2f?
-    browser.chrome? && browser.version.to_i >= 41 && !browser.device.mobile?
-  end
-
   def redirect_to_home_page_url?
     # If user is not signed-in and tries to access root_path - redirect him to landing page
     # Don't redirect to the default URL to prevent endless redirections

app/controllers/concerns/authenticates_with_two_factor.rb

@@ -57,7 +57,7 @@ module AuthenticatesWithTwoFactor
 
   # Authenticate using the response from a U2F (universal 2nd factor) device
   def authenticate_with_two_factor_via_u2f(user)
-    if U2fRegistration.authenticate(user, u2f_app_id, user_params[:device_response], session[:challenges])
+    if U2fRegistration.authenticate(user, u2f_app_id, user_params[:device_response], session[:challenge])
       # Remove any lingering user data from login
       session.delete(:otp_user_id)
       session.delete(:challenges)
@@ -77,11 +77,9 @@ module AuthenticatesWithTwoFactor
 
     if key_handles.present?
       sign_requests = u2f.authentication_requests(key_handles)
-      challenges = sign_requests.map(&:challenge)
-      session[:challenges] = challenges
-      gon.push(u2f: { challenges: challenges, app_id: u2f_app_id,
-                      sign_requests: sign_requests,
-                      browser_supports_u2f: browser_supports_u2f? })
+      session[:challenge] ||= u2f.challenge
+      gon.push(u2f: { challenge: session[:challenge], app_id: u2f_app_id,
+                      sign_requests: sign_requests })
     end
   end
 end

app/controllers/concerns/diff_for_path.rb

+module DiffForPath
+  extend ActiveSupport::Concern
+
+  def render_diff_for_path(diffs, diff_refs, project)
+    diff_file = safe_diff_files(diffs, diff_refs: diff_refs, repository: project.repository).find do |diff|
+      diff.old_path == params[:old_path] && diff.new_path == params[:new_path]
+    end
+
+    return render_404 unless diff_file
+
+    diff_commit = commit_for_diff(diff_file)
+    blob = diff_file.blob(diff_commit)
+    @expand_all_diffs = true
+
+    locals = {
+      diff_file: diff_file,
+      diff_commit: diff_commit,
+      diff_refs: diff_refs,
+      blob: blob,
+      project: project
+    }
+
+    render json: { html: view_to_html_string('projects/diffs/_content', locals) }
+  end
+end

app/controllers/dashboard/todos_controller.rb

 class Dashboard::TodosController < Dashboard::ApplicationController
-  include TodosHelper
-
   before_action :find_todos, only: [:index, :destroy_all]
 
   def index
@@ -13,7 +11,7 @@ class Dashboard::TodosController < Dashboard::ApplicationController
     respond_to do |format|
       format.html { redirect_to dashboard_todos_path, notice: 'Todo was successfully marked as done.' }
       format.js { head :ok }
-      format.json { render json: { count: todos_pending_count, done_count: todos_done_count } }
+      format.json { render json: todos_counts }
     end
   end
 
@@ -23,7 +21,7 @@ class Dashboard::TodosController < Dashboard::ApplicationController
     respond_to do |format|
       format.html { redirect_to dashboard_todos_path, notice: 'All todos were marked as done.' }
       format.js { head :ok }
-      format.json { render json: { count: todos_pending_count, done_count: todos_done_count } }
+      format.json { render json: todos_counts }
     end
   end
 
@@ -36,4 +34,11 @@ class Dashboard::TodosController < Dashboard::ApplicationController
   def find_todos
     @todos ||= TodosFinder.new(current_user, params).execute
   end
+
+  def todos_counts
+    {
+      count: TodosFinder.new(current_user, state: :pending).execute.count,
+      done_count: TodosFinder.new(current_user, state: :done).execute.count
+    }
+  end
 end

app/controllers/help_controller.rb

@@ -12,13 +12,12 @@ class HelpController < ApplicationController
   end
 
   def show
-    @category = clean_path_info(path_params[:category])
-    @file = path_params[:file]
+    @path = clean_path_info(path_params[:path])
 
     respond_to do |format|
       format.any(:markdown, :md, :html) do
         # Note: We are purposefully NOT using `Rails.root.join`
-        path = File.join(Rails.root, 'doc', @category, "#{@file}.md")
+        path = File.join(Rails.root, 'doc', "#{@path}.md")
 
         if File.exist?(path)
           @markdown = File.read(path)
@@ -33,7 +32,7 @@ class HelpController < ApplicationController
       # Allow access to images in the doc folder
       format.any(:png, :gif, :jpeg) do
         # Note: We are purposefully NOT using `Rails.root.join`
-        path = File.join(Rails.root, 'doc', @category, "#{@file}.#{params[:format]}")
+        path = File.join(Rails.root, 'doc', "#{@path}.#{params[:format]}")
 
         if File.exist?(path)
           send_file(path, disposition: 'inline')
@@ -57,8 +56,7 @@ class HelpController < ApplicationController
   private
 
   def path_params
-    params.require(:category)
-    params.require(:file)
+    params.require(:path)
 
     params
   end

app/controllers/import/gitlab_projects_controller.rb

@@ -27,10 +27,7 @@ class Import::GitlabProjectsController < Import::BaseController
         notice: "Project '#{@project.name}' is being imported."
       )
     else
-      redirect_to(
-        new_import_gitlab_project_path,
-        alert: "Project could not be imported: #{@project.errors.full_messages.join(', ')}"
-      )
+      redirect_back_or_default(options: { alert: "Project could not be imported: #{@project.errors.full_messages.join(', ')}" })
     end
   end
 

app/controllers/omniauth_callbacks_controller.rb

@@ -107,7 +107,11 @@ class OmniauthCallbacksController < Devise::OmniauthCallbacksController
     # Only allow properly saved users to login.
     if @user.persisted? && @user.valid?
       log_audit_event(@user, with: oauth['provider'])
-      sign_in_and_redirect(@user)
+      if @user.two_factor_enabled?
+        prompt_for_two_factor(@user)
+      else
+        sign_in_and_redirect(@user)
+      end
     else
       error_message = @user.errors.full_messages.to_sentence
 

app/controllers/profiles/two_factor_auths_controller.rb

@@ -100,7 +100,6 @@ class Profiles::TwoFactorAuthsController < Profiles::ApplicationController
 
     gon.push(u2f: { challenges: session[:challenges], app_id: u2f_app_id,
                     register_requests: registration_requests,
-                    sign_requests: sign_requests,
-                    browser_supports_u2f: browser_supports_u2f? })
+                    sign_requests: sign_requests })
   end
 end

app/controllers/projects/artifacts_controller.rb

@@ -23,10 +23,9 @@ class Projects::ArtifactsController < Projects::ApplicationController
     entry = build.artifacts_metadata_entry(params[:path])
 
     if entry.exists?
-      render json: { archive: build.artifacts_file.path,
-                     entry: Base64.encode64(entry.path) }
+      send_artifacts_entry(build, entry)
     else
-      render json: {}, status: 404
+      render_404
     end
   end
 

app/controllers/projects/blob_controller.rb

@@ -57,7 +57,7 @@ class Projects::BlobController < Projects::ApplicationController
     diffy = Diffy::Diff.new(@blob.data, @content, diff: '-U 3', include_diff_info: true)
     diff_lines = diffy.diff.scan(/.*\n/)[2..-1]
     diff_lines = Gitlab::Diff::Parser.new.parse(diff_lines)
-    @diff_lines = Gitlab::Diff::Highlight.new(diff_lines).highlight
+    @diff_lines = Gitlab::Diff::Highlight.new(diff_lines, repository: @repository).highlight
 
     render layout: false
   end

app/controllers/projects/commit_controller.rb

@@ -3,6 +3,7 @@
 # Not to be confused with CommitsController, plural.
 class Projects::CommitController < Projects::ApplicationController
   include CreatesCommit
+  include DiffForPath
   include DiffHelper
 
   # Authorize
@@ -11,29 +12,14 @@ class Projects::CommitController < Projects::ApplicationController
   before_action :authorize_update_build!, only: [:cancel_builds, :retry_builds]
   before_action :authorize_read_commit_status!, only: [:builds]
   before_action :commit
-  before_action :define_show_vars, only: [:show, :builds]
+  before_action :define_commit_vars, only: [:show, :diff_for_path, :builds]
+  before_action :define_status_vars, only: [:show, :builds]
+  before_action :define_note_vars, only: [:show, :diff_for_path]
   before_action :authorize_edit_tree!, only: [:revert, :cherry_pick]
 
   def show
     apply_diff_view_cookie!
 
-    @grouped_diff_notes = commit.notes.grouped_diff_notes
-    @notes = commit.notes.non_diff_notes.fresh
-    
-    Banzai::NoteRenderer.render(
-      @grouped_diff_notes.values.flatten + @notes,
-      @project,
-      current_user,
-    )
-
-    @note = @project.build_commit_note(commit)
-
-    @noteable = @commit
-    @comments_target = {
-      noteable_type: 'Commit',
-      commit_id: @commit.id
-    }
-
     respond_to do |format|
       format.html
       format.diff  { render text: @commit.to_diff }
@@ -41,6 +27,10 @@ class Projects::CommitController < Projects::ApplicationController
     end
   end
 
+  def diff_for_path
+    render_diff_for_path(@diffs, @commit.diff_refs, @project)
+  end
+
   def builds
   end
 
@@ -114,16 +104,36 @@ class Projects::CommitController < Projects::ApplicationController
     @ci_builds ||= Ci::Build.where(pipeline: pipelines)
   end
 
-  def define_show_vars
+  def define_commit_vars
     return git_not_found! unless commit
 
     opts = diff_options
     opts[:ignore_whitespace_change] = true if params[:format] == 'diff'
 
     @diffs = commit.diffs(opts)
-    @diff_refs = [commit.parent || commit, commit]
     @notes_count = commit.notes.count
+  end
+
+  def define_note_vars
+    @grouped_diff_notes = commit.notes.grouped_diff_notes
+    @notes = commit.notes.non_diff_notes.fresh
+
+    Banzai::NoteRenderer.render(
+      @grouped_diff_notes.values.flatten + @notes,
+      @project,
+      current_user,
+    )
+
+    @note = @project.build_commit_note(commit)
+
+    @noteable = @commit
+    @comments_target = {
+      noteable_type: 'Commit',
+      commit_id: @commit.id
+    }
+  end
 
+  def define_status_vars
     @statuses = CommitStatus.where(pipeline: pipelines)
     @builds = Ci::Build.where(pipeline: pipelines)
   end

app/controllers/projects/compare_controller.rb

 require 'addressable/uri'
 
 class Projects::CompareController < Projects::ApplicationController
+  include DiffForPath
   include DiffHelper
 
   # Authorize
   before_action :require_non_empty_project
   before_action :authorize_download_code!
-  before_action :assign_ref_vars, only: [:index, :show]
+  before_action :define_ref_vars, only: [:index, :show, :diff_for_path]
+  before_action :define_diff_vars, only: [:show, :diff_for_path]
   before_action :merge_request, only: [:index, :show]
 
   def index
   end
 
   def show
-    compare = CompareService.new.
-      execute(@project, @head_ref, @project, @base_ref, diff_options)
+  end
 
-    if compare
-      @commits = Commit.decorate(compare.commits, @project)
-      @commit = @project.commit(@head_ref)
-      @base_commit = @project.merge_base_commit(@base_ref, @head_ref)
-      @diffs = compare.diffs(diff_options)
-      @diff_refs = [@base_commit, @commit]
-      @diff_notes_disabled = true
-      @grouped_diff_notes = {}
-    end
+  def diff_for_path
+    return render_404 unless @compare
+
+    render_diff_for_path(@diffs, @diff_refs, @project)
   end
 
   def create
@@ -34,13 +30,35 @@ class Projects::CompareController < Projects::ApplicationController
 
   private
 
-  def assign_ref_vars
-    @base_ref = Addressable::URI.unescape(params[:from])
+  def define_ref_vars
+    @start_ref = Addressable::URI.unescape(params[:from])
     @ref = @head_ref = Addressable::URI.unescape(params[:to])
   end
 
+  def define_diff_vars
+    @compare = CompareService.new.execute(@project, @head_ref, @project, @start_ref)
+
+    if @compare
+      @commits = Commit.decorate(@compare.commits, @project)
+
+      @start_commit = @project.commit(@start_ref)
+      @commit = @project.commit(@head_ref)
+      @base_commit = @project.merge_base_commit(@start_ref, @head_ref)
+
+      @diffs = @compare.diffs(diff_options)
+      @diff_refs = Gitlab::Diff::DiffRefs.new(
+        base_sha: @base_commit.try(:sha),
+        start_sha: @start_commit.try(:sha),
+        head_sha: @commit.try(:sha)
+      )
+
+      @diff_notes_disabled = true
+      @grouped_diff_notes = {}
+    end
+  end
+
   def merge_request
     @merge_request ||= @project.merge_requests.opened.
-      find_by(source_project: @project, source_branch: @head_ref, target_branch: @base_ref)
+      find_by(source_project: @project, source_branch: @head_ref, target_branch: @start_ref)
   end
 end

app/controllers/projects/git_http_controller.rb

@@ -19,6 +19,8 @@ class Projects::GitHttpController < Projects::ApplicationController
       render_ok
     elsif receive_pack? && receive_pack_allowed?
       render_ok
+    elsif http_blocked?
+      render_not_allowed
     else
       render_not_found
     end
@@ -154,6 +156,10 @@ class Projects::GitHttpController < Projects::ApplicationController
     render plain: 'Not Found', status: :not_found
   end
 
+  def render_not_allowed
+    render plain: download_access.message, status: :forbidden
+  end
+
   def ci?
     @ci.present?
   end
@@ -162,12 +168,28 @@ class Projects::GitHttpController < Projects::ApplicationController
     return false unless Gitlab.config.gitlab_shell.upload_pack
 
     if user
-      Gitlab::GitAccess.new(user, project).download_access_check.allowed?
+      download_access.allowed?
     else
       ci? || project.public?
     end
   end
 
+  def access
+    return @access if defined?(@access)
+
+    @access = Gitlab::GitAccess.new(user, project, 'http')
+  end
+
+  def download_access
+    return @download_access if defined?(@download_access)
+
+    @download_access = access.check('git-upload-pack')
+  end
+
+  def http_blocked?
+    !access.protocol_allowed?
+  end
+
   def receive_pack_allowed?
     return false unless Gitlab.config.gitlab_shell.receive_pack
 

app/controllers/projects/merge_requests_controller.rb

 class Projects::MergeRequestsController < Projects::ApplicationController
   include ToggleSubscriptionAction
+  include DiffForPath
   include DiffHelper
   include IssuableActions
   include ToggleAwardEmoji
@@ -9,10 +10,11 @@ class Projects::MergeRequestsController < Projects::ApplicationController
     :edit, :update, :show, :diffs, :commits, :builds, :merge, :merge_check,
     :ci_status, :toggle_subscription, :cancel_merge_when_build_succeeds, :remove_wip
   ]
-  before_action :closes_issues, only: [:edit, :update, :show, :diffs, :commits, :builds]
   before_action :validates_merge_request, only: [:show, :diffs, :commits, :builds]
   before_action :define_show_vars, only: [:show, :diffs, :commits, :builds]
   before_action :define_widget_vars, only: [:merge, :cancel_merge_when_build_succeeds, :merge_check]
+  before_action :define_commit_vars, only: [:diffs]
+  before_action :define_diff_comment_vars, only: [:diffs]
   before_action :ensure_ref_fetched, only: [:show, :diffs, :commits, :builds]
 
   # Allow read any merge_request
@@ -53,19 +55,19 @@ class Projects::MergeRequestsController < Projects::ApplicationController
   end
 
   def show
-    @note_counts = Note.where(commit_id: @merge_request.commits.map(&:id)).
-      group(:commit_id).count
-
     respond_to do |format|
-      format.html
-      format.json   { render json: @merge_request }
+      format.html { define_discussion_vars }
+
+      format.json do
+        render json: @merge_request
+      end
+
       format.patch  do
-        headers.store(*Gitlab::Workhorse.send_git_patch(@project.repository,
-                                                        @merge_request.diff_base_commit.id,
-                                                        @merge_request.last_commit.id))
-        headers['Content-Disposition'] = 'inline'
-        head :ok
+        return render_404 unless @merge_request.diff_refs
+
+        send_git_patch @project.repository, @merge_request.diff_refs
       end
+
       format.diff do
         return render_404 unless @merge_request.diff_refs
 
@@ -77,52 +79,65 @@ class Projects::MergeRequestsController < Projects::ApplicationController
   def diffs
     apply_diff_view_cookie!
 
-    @commit = @merge_request.last_commit
-    @base_commit = @merge_request.diff_base_commit
-
-    # MRs created before 8.4 don't have a diff_base_commit,
-    # but we need it for the "View file @ ..." link by deleted files
-    @base_commit ||= @merge_request.first_commit.parent || @merge_request.first_commit
-
-    @comments_target = {
-      noteable_type: 'MergeRequest',
-      noteable_id: @merge_request.id
-    }
-
-    @grouped_diff_notes = @merge_request.notes.grouped_diff_notes
-
-    Banzai::NoteRenderer.render(
-      @grouped_diff_notes.values.flatten,
-      @project,
-      current_user,
-      @path,
-      @project_wiki,
-      @ref
-    )
+    @merge_request_diff = @merge_request.merge_request_diff
 
     respond_to do |format|
-      format.html
+      format.html { define_discussion_vars }
       format.json { render json: { html: view_to_html_string("projects/merge_requests/show/_diffs") } }
     end
   end
 
+  # With an ID param, loads the MR at that ID. Otherwise, accepts the same params as #new
+  # and uses that (unsaved) MR.
+  #
+  def diff_for_path
+    if params[:id]
+      merge_request
+      define_diff_comment_vars
+    else
+      build_merge_request
+      @diff_notes_disabled = true
+      @grouped_diff_notes = {}
+    end
+
+    define_commit_vars
+    diffs = @merge_request.diffs(diff_options)
+
+    render_diff_for_path(diffs, @merge_request.diff_refs, @merge_request.project)
+  end
+
   def commits
     respond_to do |format|
-      format.html { render 'show' }
-      format.json { render json: { html: view_to_html_string('projects/merge_requests/show/_commits') } }
+      format.html do
+        define_discussion_vars
+
+        render 'show'
+      end
+      format.json do
+        # Get commits from repository
+        # or from cache if already merged
+        @commits = @merge_request.commits
+        @note_counts = Note.where(commit_id: @commits.map(&:id)).
+          group(:commit_id).count
+
+        render json: { html: view_to_html_string('projects/merge_requests/show/_commits') }
+      end
     end
   end
 
   def builds
     respond_to do |format|
-      format.html { render 'show' }
+      format.html do
+        define_discussion_vars
+
+        render 'show'
+      end
       format.json { render json: { html: view_to_html_string('projects/merge_requests/show/_builds') } }
     end
   end
 
   def new
-    params[:merge_request] ||= ActionController::Parameters.new(source_project: @project)
-    @merge_request = MergeRequests::BuildService.new(project, current_user, merge_request_params).execute
+    build_merge_request
     @noteable = @merge_request
 
     @target_branches = if @merge_request.target_project
@@ -134,7 +149,7 @@ class Projects::MergeRequestsController < Projects::ApplicationController
     @target_project = merge_request.target_project
     @source_project = merge_request.source_project
     @commits = @merge_request.compare_commits.reverse
-    @commit = @merge_request.last_commit
+    @commit = @merge_request.diff_head_commit
     @base_commit = @merge_request.diff_base_commit
     @diffs = @merge_request.compare.diffs(diff_options) if @merge_request.compare
     @diff_notes_disabled = true
@@ -212,7 +227,7 @@ class Projects::MergeRequestsController < Projects::ApplicationController
       return
     end
 
-    if params[:sha] != @merge_request.source_sha
+    if params[:sha] != @merge_request.diff_head_sha
       @status = :sha_mismatch
       return
     end
@@ -274,16 +289,16 @@ class Projects::MergeRequestsController < Projects::ApplicationController
       status ||= "preparing"
     else
       ci_service = @merge_request.source_project.ci_service
-      status = ci_service.commit_status(merge_request.last_commit.sha, merge_request.source_branch) if ci_service
+      status = ci_service.commit_status(merge_request.diff_head_sha, merge_request.source_branch) if ci_service
 
       if ci_service.respond_to?(:commit_coverage)
-        coverage = ci_service.commit_coverage(merge_request.last_commit.sha, merge_request.source_branch)
+        coverage = ci_service.commit_coverage(merge_request.diff_head_sha, merge_request.source_branch)
       end
     end
 
     response = {
       title: merge_request.title,
-      sha: merge_request.last_commit_short_sha,
+      sha: merge_request.diff_head_commit.short_id,
       status: status,
       coverage: coverage
     }
@@ -308,10 +323,6 @@ class Projects::MergeRequestsController < Projects::ApplicationController
   alias_method :issuable, :merge_request
   alias_method :awardable, :merge_request
 
-  def closes_issues
-    @closes_issues ||= @merge_request.closes_issues
-  end
-
   def authorize_update_merge_request!
     return render_404 unless can?(current_user, :update_merge_request, @merge_request)
   end
@@ -340,14 +351,30 @@ class Projects::MergeRequestsController < Projects::ApplicationController
   end
 
   def define_show_vars
+    @noteable = @merge_request
+    @commits_count = @merge_request.commits.count
+
+    @pipeline = @merge_request.pipeline
+    @statuses = @pipeline.statuses if @pipeline
+
+    if @merge_request.locked_long_ago?
+      @merge_request.unlock_mr
+      @merge_request.close
+    end
+  end
+
+  # Discussion tab data is rendered on html responses of actions
+  # :show, :diff, :commits, :builds. but not when request the data through AJAX
+  def define_discussion_vars
     # Build a note object for comment form
-    @note = @project.notes.new(noteable: @merge_request)
+    @note = @project.notes.new(noteable: @noteable)
 
-    @discussions = @merge_request.mr_and_commit_notes.
+    @discussions = @noteable.mr_and_commit_notes.
       inc_author_project_award_emoji.
       fresh.
       discussions
 
+    # This is not executed lazily
     @notes = Banzai::NoteRenderer.render(
       @discussions.flatten,
       @project,
@@ -356,28 +383,35 @@ class Projects::MergeRequestsController < Projects::ApplicationController
       @project_wiki,
       @ref
     )
-
-    @noteable = @merge_request
-
-    # Get commits from repository
-    # or from cache if already merged
-    @commits = @merge_request.commits
-
-    @merge_request_diff = @merge_request.merge_request_diff
-
-    @pipeline = @merge_request.pipeline
-    @statuses = @pipeline.statuses if @pipeline
-
-    if @merge_request.locked_long_ago?
-      @merge_request.unlock_mr
-      @merge_request.close
-    end
   end
 
   def define_widget_vars
     @pipeline = @merge_request.pipeline
     @pipelines = [@pipeline].compact
-    closes_issues
+  end
+
+  def define_commit_vars
+    @commit = @merge_request.diff_head_commit
+    @base_commit = @merge_request.diff_base_commit || @merge_request.likely_diff_base_commit
+  end
+
+  def define_diff_comment_vars
+    @comments_target = {
+      noteable_type: 'MergeRequest',
+      noteable_id: @merge_request.id
+    }
+
+    @use_legacy_diff_notes = !@merge_request.support_new_diff_notes?
+    @grouped_diff_notes = @merge_request.notes.grouped_diff_notes
+
+    Banzai::NoteRenderer.render(
+      @grouped_diff_notes.values.flatten,
+      @project,
+      current_user,
+      @path,
+      @project_wiki,
+      @ref
+    )
   end
 
   def invalid_mr
@@ -408,4 +442,9 @@ class Projects::MergeRequestsController < Projects::ApplicationController
     params[:merge_when_build_succeeds].present? &&
       @merge_request.pipeline && @merge_request.pipeline.active?
   end
+
+  def build_merge_request
+    params[:merge_request] ||= ActionController::Parameters.new(source_project: @project)
+    @merge_request = MergeRequests::BuildService.new(project, current_user, merge_request_params).execute
+  end
 end