[ci skip]

Update grape-entity to 0.6.0

See merge request !7491

Fix missing access checks on issue lookup using IssuableFinder

Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867

⚠ - Potentially untested
💣 - No test coverage
🚥 - Test coverage of some sort exists (a test failed when error raised)
🚦 - Test coverage of return value (a test failed when nil used)
✅ - Permissions check tested

- [x] ✅ app/controllers/projects/branches_controller.rb:39
  - `before_action :authorize_push_code!` helpes limit/prevent exploitation. Always checks for reporter access so fine with
    confidential issues, issues only visible to team, etc.
- [x] 🚥 app/models/cycle_analytics/summary.rb:9 [`.count`]
- [x] ✅ app/controllers/projects/todos_controller.rb:19

- [x] Potential double render in app/controllers/projects/todos_controller.rb

- https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#cedccb227af9bfdf88802767cb58d43c2b977439_24_24

See merge request !2030

Replace issue access checks with use of IssuableFinder

Split from !2024 to partially solve https://gitlab.com/gitlab-org/gitlab-ce/issues/23867

## Which fixes are in this MR?

⚠ - Potentially untested  
💣 - No test coverage  
🚥 - Test coverage of some sort exists (a test failed when error raised)  
🚦 - Test coverage of return value (a test failed when nil used)  
✅ - Permissions check tested

### Issue lookup with access check

Using `visible_to_user` likely makes these security issues too. See [Code smells](#code-smells).

- [x] 🚦 app/finders/notes_finder.rb:15 [`visible_to_user`]
- [x] 🚥 app/views/layouts/nav/_project.html.haml:73 [`visible_to_user`] [`.count`]
- [x] ✅ app/services/merge_requests/build_service.rb:84 [`issue.try(:confidential?)`]
- [x] ✅ lib/api/issues.rb:112 [`visible_to_user`]
  - CHANGELOG: Prevented API returning issues set to 'Only team members' to everyone
- [x] ✅ lib/api/helpers.rb:126 [`can?(current_user, :read_issue, issue)`] Maybe here too?
- [x] ✅ lib/gitlab/search_results.rb:53 [`visible_to_user`]

### Previous discussions
- [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#b2ff264eddf9819d7693c14ae213d941494fe2b3_128_126
- [ ] https://dev.gitlab.org/gitlab/gitlabhq/merge_requests/2024/diffs#7b6375270d22f880bdcb085e47b519b426a5c6c7_87_87

See merge request !2031

Fix information disclosure in `Projects::BlobController#update`

It was possible to discover private project names by modifying `from_merge_request`parameter in `Projects::BlobController#update`. This fixes that.

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG.md) entry added
- Tests
  - [x] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

https://gitlab.com/gitlab-org/gitlab-ce/issues/22869

See merge request !2023

Fix label creation non members

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/23416

See merge request !2006

Fix deselecting calendar days on contribution graph

## What does this MR do?
Fix deselecting calendar days on contribution graph

## Are there points in the code the reviewer needs to double check?
Shouldn't be

## Why was this MR needed?
In `master`, you can currently deselect a calendar day after selecting but you cannot reselect that day.

## Screenshots (if relevant)
Before:
![2016-10-25_10.42.20](/uploads/7d442c09cd15082cf69f673a544b56f9/2016-10-25_10.42.20.gif)

After:
![2016-10-25_10.40.35](/uploads/6123365f0ec63ee84658ee6057e7715c/2016-10-25_10.40.35.gif)

## Does this MR meet the acceptance criteria?

- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- Tests
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?
Closes #22381

See merge request !6453

Unify all MR widget text colors and background colors

* Removes darker background color for `skipped` status
* Makes all MR widget text gray
Before:   
![Screen_Shot_2016-11-18_at_7.52.16_AM](/uploads/4ee715aec9c453c5cfe1f259049adbde/Screen_Shot_2016-11-18_at_7.52.16_AM.png)
After:   
![Screen_Shot_2016-11-18_at_7.52.05_AM](/uploads/ea14d713a4e7d837bac4576815451dce/Screen_Shot_2016-11-18_at_7.52.05_AM.png)

Closes #24639

See merge request !7571

If Build running change accept merge request when build succeeds button from orange to blue

## What does this MR do?

If Build running change accept merge request when build succeeds button from orange to blue

## Are there points in the code the reviewer needs to double check?

I didn't really check, but to my knowledge these changes should fix it. Would love to know how to set up working pipelines in my local build.

## Why was this MR needed?

orange was to big a warning color for this button


## Screenshots (if relevant)

![image](https://gitlab.com/gitlab-org/gitlab-ce/uploads/c9100be272c5567ee4dfa281cffaeb7a/_24266_merge-request-01.png)
![image](https://gitlab.com/gitlab-org/gitlab-ce/uploads/bb84ea5b519fc67babf8383f3b396fb7/_24266_merge-request-02.png)

## Does this MR meet the acceptance criteria?

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [ ] All builds are passing
- [ ] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [ ] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [ ] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?


Closes #24266

See merge request !7577

move timeago.js to vendor directory

## What does this MR do?

moves timeago.js into `/vendor/assets/javascripts` for consistency with other external javascript libraries.

## Are there points in the code the reviewer needs to double check?

make sure timeago still works as it should...?  I don't see how this could have broken anything.

## Why was this MR needed?

consistency with our guidelines

## Does this MR meet the acceptance criteria?

- Tests
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

See discussion in [!6274](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/6274#note_18625583)

See merge request !7590

Merge branch '24161-non-intuitive-buttons-for-import-sources-in-administrator-settings-enable-disable' into 'master'

Import sources buttons to checkboxes

## What does this MR do?

Swaps the `/application_settings` `Import Sources` buttons to checkboxes.

## Are there points in the code the reviewer needs to double check?

## Why was this MR needed?

## Screenshots (if relevant)

![2016-11-19_14.42.39](/uploads/5bf53ecb54765bd80ab275714208ee9a/2016-11-19_14.42.39.gif)

## Does this MR meet the acceptance criteria?

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?


Closes #24161

See merge request !7598

External jobs do not have show page nor traces

Fixes #24677

See merge request !7617

Issue creation now accepts trailing whitespace

See merge request !7633

Resolve "Labeling system notes downcase labels"

## What does this MR do?
This MR fixes issues of label gets lowercase in system note as describe in #24737

## Are there points in the code the reviewer needs to double check?
NR
## Why was this MR needed?
This MR fixes the regression of becoming labels and its description and title lowercase in system note
  
## Screenshots (if relevant)
**Before:**
![before](/uploads/ac99fd5d1219ee3b4b7c699319267087/before.png)

**After:** 
![after](/uploads/d1b6413c857d18f122252f421ac498b0/after.png)

## Does this MR meet the acceptance criteria?

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?


Closes #24737 
Closes #24751

See merge request !7636

Fix NPM install warnings due to incompatible dependency version

## What does this MR do?

Rolls back `eslint-plugin-import` to semver `^1.16.0` for compatibility with `eslint-config-airbnb`.

## Are there points in the code the reviewer needs to double check?

Shouldn't be.

## Why was this MR needed?

A warning message was being generated every time we run `npm install`, and there are possibly other side effects due to module incompatibility.

## Does this MR meet the acceptance criteria?

- [x] All builds are passing
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)

## What are the relevant issue numbers?

Closes #24754

See merge request !7641

Clean up globals exemptions within .eslintrc

## What does this MR do?

Removes unnecessarily-exempted globals from `.eslintrc` where possible.

## Are there points in the code the reviewer needs to double check?

`npm run eslint` should return 0 errors.

## Why was this MR needed?

see Issue #24756 

## Does this MR meet the acceptance criteria?

- Tests
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

Closes #24756

See merge request !7642

Last minute CI Style tweaks for 8.14

## What does this MR do?
- Skipped builds now have use a lighter gray.
- Converted all status icons to be managed by scss colors only
- Consolidated all status icon styles into icons.scss
- Deleted any classes or styles within the svg's
- Gave status badges a hover style, but only if clickable
- Fixed alignment issue mini-pipeline graph

## Are there points in the code the reviewer needs to double check?

## Why was this MR needed?
As per the discussion in the slack chat https://gitlab.slack.com/archives/ci/p1479743986004879

## Screenshots (if relevant)
- skipped builds:
![image](/uploads/f59c615045472b9b13940463a64c8038/image.png)
![image](/uploads/26503d1da9c93b3c22c5c0c1369feceb/image.png)

- hover style status badges:
![2016-11-22_00.21.27](/uploads/36afa7aa64d60e1755bf39d97f90c59f/2016-11-22_00.21.27.gif)![2016-11-22_00.58.38](/uploads/1d95fa5db124412d3f83b3e79b9b71ec/2016-11-22_00.58.38.gif)

- mini pipeline graph:

before:
![image](/uploads/38e5e57ada3907b17c6e24e1446b4514/image.png)


after:
![image](/uploads/de4476693a1397eebfc680661159daf7/image.png)


## Does this MR meet the acceptance criteria?

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [ ] All builds are passing
- [ ] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [ ] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [ ] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

See merge request !7643

Fix IID filter for merge requests and milestones

I updated the example in the docs and added a test. The milestones API was also broken for the same reason.

Related to !7358 and !7373

See merge request !7648

Fix Sidekiq stats in admin area

Closes #23825, #24675 

See merge request !7654

Fix exceptions when loading build trace

## What does this MR do?

This MR fixes exceptions when loading build trace.

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- [x] Tests added for this feature/bug

## What are the relevant issue numbers?

Closes #24638

See merge request !7658

fixed bug to do with calculating durations

Fixes a couple of small bugs while calculating durations in cycle analytics - probably due to some bad refactoring

- [ ] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- Tests
  - [x] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/24796

See merge request !7663

Merge branch '24804-wrong-render-index-should-be-render-show-in-projects-pipelinessettingscontroller-update' into 'master'

Resolve "Wrong `render 'index'`, should be `render 'show'` in `Projects::PipelinesSettingsController#update`"

Closes #24804

See merge request !7665

changes environment.last_deployment to a try expression so it does not fail if e…

## What does this MR do?

Fixes the call on `environment.last_deployment` to not break when `environment`is not yet set.

## Does this MR meet the acceptance criteria?

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- [x] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [x] API support added
- Tests
  - [x] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?


Closes #24779

See merge request !7671

Add changes to JIRA api docs

See merge request !7675

Fix spacing between icon and word in status badge

Before:      
![Screen_Shot_2016-11-22_at_11.44.16_AM](/uploads/65c5abc6dc08985cb3079b7c2af03715/Screen_Shot_2016-11-22_at_11.44.16_AM.png)
After:   
![Screen_Shot_2016-11-22_at_11.44.01_AM](/uploads/1b6261b64c65de5a718b68873e069ac9/Screen_Shot_2016-11-22_at_11.44.01_AM.png)

cc @dimitrieh

See merge request !7678

Sort pipeline graph builds and build groups by name

## What does this MR do?

Sorts builds and build groups by name within pipeline graphs

## Are there points in the code the reviewer needs to double check?

Shouldn't be. This was a one-line change.

## Why was this MR needed?

It can be difficult to find the build you are looking for within a group of similarly-named builds when they are in a seemingly random order.

## Screenshots (if relevant)

### Before:

![Screen_Shot_2016-11-22_at_2.48.11_PM](/uploads/27f3f9a2e29e7f0e5857bfd425b74306/Screen_Shot_2016-11-22_at_2.48.11_PM.png)

### After:

![Screen_Shot_2016-11-22_at_2.47.46_PM](/uploads/2c6ef1446a1de0012d091d6deef0992b/Screen_Shot_2016-11-22_at_2.47.46_PM.png)

## Does this MR meet the acceptance criteria?

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- Tests
  - [ ] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

## What are the relevant issue numbers?

Closes #24739

See merge request !7681

Fix cycle analytics plan stage when commits are missing

Takes into account when commits are `nil` so the app doesn't throw an exception and also removes them.

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/24836

- [x] [Changelog entry](https://docs.gitlab.com/ce/development/changelog.html) added
- Tests
  - [x] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [merge request performance guides](http://docs.gitlab.com/ce/development/merge_request_performance_guidelines.html)
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if it does - rebase it please)
- [ ] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)


See merge request !7694

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/24863

See merge request !7698

Fixed dragging issues on issue boards

## What does this MR do?

This fixes a few issues all at once:

- Fixes an issue when dragging an issue to a list but actually removes another issue from the original list
- Fixes an issue that caused the issue card to be appended to the bottom of the list
- Fixes an issue when dragging an issue would actually open up the sidebar

## What are the relevant issue numbers?

Closes #24654

See merge request !7701

Fix `LFS enabled` select box.

A refactor of the project edit page caused the `lfs_enabled` setting to be reverted to a non functioning state. This MR fixes that.

This will most likely need to be ported back to 8.13 and 8.14. 8.12 contained the correct code.

Fixes #24645 

Related commits:

- ea3bbbde
- da07c2e4

cc @stanhu @dblessing @dbalexandre @rymai

See merge request !7716

[ci skip]

See merge request !7676

See merge request !7672

Do not use MergeRequest#commits in define_pipelines_vars

## What does this MR do?

`MergeRequest#commits` requires merge_request_diff to be present.
This is not the case when creating a new merge request.

## What are the relevant issue numbers?

Fix up for https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7568

Fixes https://gitlab.com/gitlab-org/gitlab-ce/issues/24798

See merge request !7664

Preserve optional second parameter in NewNoteWorker jobs
    
Closes #24678

See merge request !7602

Handle orphans when removing soft deleted groups

This fixes the migration from https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7528 so it handles orphans as mentioned in https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/7528/diffs#note_18800962.

This needs to go in 8.14.0 as otherwise customers may run into the same problem.

See merge request !7657

Add new image for Cycle Analytics

See merge request !7666