Merge tag 'v7.2.0.rc1'

Bump version to 7.2.0.rc1

Conflicts:
	VERSION

PROCESS.md

@@ -34,7 +34,7 @@ The most important thing is making sure valid issues receive feedback from the d
 
 ## Workflow labels
 
-Workflow labels are purposely not very detailed since that would be hard to keep updated as you would need to reevaluate them after every comment. We optionally use functional labels on demand when want to group related issues to get an overview (for example all issues related to RVM, to tackle them in one go) and to add details to the issue. 
+Workflow labels are purposely not very detailed since that would be hard to keep updated as you would need to re-evaluate them after every comment. We optionally use functional labels on demand when want to group related issues to get an overview (for example all issues related to RVM, to tackle them in one go) and to add details to the issue. 
 
 -   *Awaiting feedback*: Feedback pending from the reporter
 -   *Awaiting confirmation of fix*: The issue should already be solved in **master** (generally you can avoid this workflow item and just close the issue right away)
@@ -61,7 +61,7 @@ If an issue is complex and needs the attention of a specific person, assignment
 
 ## Be kind
 
-Be kind to people trying to contribute. Be aware that people can be a non-native or a native English speaker, they might not understand thing or they might be very sensitive to how your word things. Use emoji to express your feelings (heart, star, smile, etc.). Some good tips about giving feedback to merge requests is in the [Thoughtbot code review guide](https://github.com/thoughtbot/guides/tree/master/code-review).
+Be kind to people trying to contribute. Be aware that people may be a non-native English speaker, they might not understand things or they might be very sensitive as to how you word things. Use Emoji to express your feelings (heart, star, smile, etc.). Some good tips about giving feedback to merge requests is in the [Thoughtbot code review guide](https://github.com/thoughtbot/guides/tree/master/code-review).
 
 ## Copy & paste responses
 

VERSION

-7.2.0-ee.pre
+7.2.0.rc1-ee

config/initializers/1_settings.rb

@@ -133,7 +133,7 @@ Settings.backup['path']         = File.expand_path(Settings.backup['path'] || "t
 # Git
 #
 Settings['git'] ||= Settingslogic.new({})
-Settings.git['max_size']  ||= 5242880 # 5.megabytes
+Settings.git['max_size']  ||= 20971520 # 20.megabytes
 Settings.git['bin_path']  ||= '/usr/bin/git'
 Settings.git['timeout']   ||= 10
 

doc/api/README.md

@@ -31,7 +31,7 @@
 
 ## Introduction
 
-All API requests require authentication. You need to pass a `private_token` parameter by url or header. If passed as header, the header name must be "PRIVATE-TOKEN" (capital and with dash instead of underscore). You can find or reset your private token in your profile.
+All API requests require authentication. You need to pass a `private_token` parameter by URL or header. If passed as header, the header name must be "PRIVATE-TOKEN" (capital and with dash instead of underscore). You can find or reset your private token in your profile.
 
 If no, or an invalid, `private_token` is provided then an error message will be returned with status code 401:
 
@@ -65,14 +65,14 @@ API request types:
 
 - `GET` requests access one or more resources and return the result as JSON
 - `POST` requests return `201 Created` if the resource is successfully created and return the newly created resource as JSON
-- `GET`, `PUT` and `DELETE` return `200 Ok` if the resource is accessed, modified or deleted successfully, the (modified) result is returned as JSON
-- `DELETE` requests are designed to be idempotent, meaning a request a resource still returns `200 Ok` even it was deleted before or is not available. The reasoning behind it is the user is not really interested if the resource existed before or not.
+- `GET`, `PUT` and `DELETE` return `200 OK` if the resource is accessed, modified or deleted successfully, the (modified) result is returned as JSON
+- `DELETE` requests are designed to be idempotent, meaning a request a resource still returns `200 OK` even it was deleted before or is not available. The reasoning behind it is the user is not really interested if the resource existed before or not.
 
 The following list shows the possible return codes for API requests.
 
 Return values:
 
-- `200 Ok` - The `GET`, `PUT` or `DELETE` request was successful, the resource(s) itself is returned as JSON
+- `200 OK` - The `GET`, `PUT` or `DELETE` request was successful, the resource(s) itself is returned as JSON
 - `201 Created` - The `POST` request was successful and the resource is returned as JSON
 - `400 Bad Request` - A required attribute of the API request is missing, e.g. the title of an issue is not given
 - `401 Unauthorized` - The user is not authenticated, a valid user token is necessary, see above

doc/api/branches.md

@@ -41,7 +41,6 @@ Parameters:
 ]
 ```
 
-
 ## Get single repository branch
 
 Get a single project repository branch.
@@ -85,7 +84,7 @@ Parameters:
 ## Protect repository branch
 
 Protects a single project repository branch. This is an idempotent function, protecting an already
-protected repository branch still returns a `200 Ok` status code.
+protected repository branch still returns a `200 OK` status code.
 
 ```
 PUT /projects/:id/repository/branches/:branch/protect
@@ -126,7 +125,7 @@ Parameters:
 ## Unprotect repository branch
 
 Unprotects a single project repository branch. This is an idempotent function, unprotecting an already
-unprotected repository branch still returns a `200 Ok` status code.
+unprotected repository branch still returns a `200 OK` status code.
 
 ```
 PUT /projects/:id/repository/branches/:branch/unprotect
@@ -199,14 +198,13 @@ Parameters:
 
 ## Delete repository branch
 
-
 ```
 DELETE /projects/:id/repository/branches/:branch
 ```
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `branch` (required) - The name of the branch
+- `id` (required) - The ID of a project
+- `branch` (required) - The name of the branch
 
 It return 200 if succeed or 405 if failed with error message explaining reason.

doc/api/groups.md

@@ -19,7 +19,6 @@ GET /groups
 ]
 ```
 
-
 ## Details of a group
 
 Get all details of a group.
@@ -30,8 +29,7 @@ GET /groups/:id
 
 Parameters:
 
-+ `id` (required) - The ID of a group
-
+- `id` (required) - The ID of a group
 
 ## New group
 
@@ -43,8 +41,8 @@ POST /groups
 
 Parameters:
 
-+ `name` (required) - The name of the group
-+ `path` (required) - The path of the group
+- `name` (required) - The name of the group
+- `path` (required) - The path of the group
 
 ## Transfer project to group
 
@@ -55,9 +53,9 @@ POST  /groups/:id/projects/:project_id
 ```
 
 Parameters:
-+ `id` (required) - The ID of a group
-+ `project_id` (required) - The ID of a project
 
+- `id` (required) - The ID of a group
+- `project_id` (required) - The ID of a project
 
 ## Remove group
 
@@ -69,22 +67,20 @@ DELETE /groups/:id
 
 Parameters:
 
-+ `id` (required) - The ID of a user group
-
+- `id` (required) - The ID of a user group
 
 ## Group members
 
-
 **Group access levels**
 
 The group access levels are defined in the `Gitlab::Access` module. Currently, these levels are recognized:
 
 ```
-  GUEST     = 10
-  REPORTER  = 20
-  DEVELOPER = 30
-  MASTER    = 40
-  OWNER     = 50
+GUEST     = 10
+REPORTER  = 20
+DEVELOPER = 30
+MASTER    = 40
+OWNER     = 50
 ```
 
 ### List group members
@@ -128,10 +124,9 @@ POST /groups/:id/members
 
 Parameters:
 
-+ `id` (required) - The ID of a group
-+ `user_id` (required) - The ID of a user to add
-+ `access_level` (required) - Project access level
-
+- `id` (required) - The ID of a group
+- `user_id` (required) - The ID of a user to add
+- `access_level` (required) - Project access level
 
 ### Remove user team member
 
@@ -143,5 +138,5 @@ DELETE /groups/:id/members/:user_id
 
 Parameters:
 
-+ `id` (required) - The ID of a user group
-+ `user_id` (required) - The ID of a group member
+- `id` (required) - The ID of a user group
+- `user_id` (required) - The ID of a group member

doc/api/merge_requests.md

@@ -196,13 +196,13 @@ If an error occurs, an error number and a message explaining the reason is retur
 
 Merge changes submitted with MR using this API.
 
-If merge success you get 200 OK.
+If merge success you get `200 OK`.
 
 If it has some conflicts and can not be merged - you get 405 and error message 'Branch cannot be merged'
 
 If merge request is already merged or closed - you get 405 and error message 'Method Not Allowed'
 
-If you dont have permissions to accept this merge request - you get 401
+If you don't have permissions to accept this merge request - you'll get a 401
 
 ```
 PUT /projects/:id/merge_request/:merge_request_id/merge

doc/api/notes.md

@@ -14,8 +14,8 @@ GET /projects/:id/issues/:issue_id/notes
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `issue_id` (required) - The ID of an issue
+- `id` (required) - The ID of a project
+- `issue_id` (required) - The ID of an issue
 
 ```json
 [
@@ -60,10 +60,9 @@ GET /projects/:id/issues/:issue_id/notes/:note_id
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `issue_id` (required) - The ID of a project issue
-+ `note_id` (required) - The ID of an issue note
-
+- `id` (required) - The ID of a project
+- `issue_id` (required) - The ID of a project issue
+- `note_id` (required) - The ID of an issue note
 
 ### Create new issue note
 
@@ -75,10 +74,9 @@ POST /projects/:id/issues/:issue_id/notes
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `issue_id` (required) - The ID of an issue
-+ `body` (required) - The content of a note
-
+- `id` (required) - The ID of a project
+- `issue_id` (required) - The ID of an issue
+- `body` (required) - The content of a note
 
 ## Snippets
 
@@ -92,9 +90,8 @@ GET /projects/:id/snippets/:snippet_id/notes
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `snippet_id` (required) - The ID of a project snippet
-
+- `id` (required) - The ID of a project
+- `snippet_id` (required) - The ID of a project snippet
 
 ### Get single snippet note
 
@@ -106,9 +103,9 @@ GET /projects/:id/snippets/:snippet_id/notes/:note_id
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `snippet_id` (required) - The ID of a project snippet
-+ `note_id` (required) - The ID of an snippet note
+- `id` (required) - The ID of a project
+- `snippet_id` (required) - The ID of a project snippet
+- `note_id` (required) - The ID of an snippet note
 
 ```json
 {
@@ -139,10 +136,9 @@ POST /projects/:id/snippets/:snippet_id/notes
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `snippet_id` (required) - The ID of an snippet
-+ `body` (required) - The content of a note
-
+- `id` (required) - The ID of a project
+- `snippet_id` (required) - The ID of an snippet
+- `body` (required) - The content of a note
 
 ## Merge Requests
 
@@ -156,9 +152,8 @@ GET /projects/:id/merge_requests/:merge_request_id/notes
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `merge_request_id` (required) - The ID of a project merge request
-
+- `id` (required) - The ID of a project
+- `merge_request_id` (required) - The ID of a project merge request
 
 ### Get single merge request note
 
@@ -170,9 +165,9 @@ GET /projects/:id/merge_requests/:merge_request_id/notes/:note_id
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `merge_request_id` (required) - The ID of a project merge request
-+ `note_id` (required) - The ID of a merge request note
+- `id` (required) - The ID of a project
+- `merge_request_id` (required) - The ID of a project merge request
+- `note_id` (required) - The ID of a merge request note
 
 ```json
 {
@@ -201,7 +196,6 @@ POST /projects/:id/merge_requests/:merge_request_id/notes
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `merge_request_id` (required) - The ID of a merge request
-+ `body` (required) - The content of a note
-
+- `id` (required) - The ID of a project
+- `merge_request_id` (required) - The ID of a merge request
+- `body` (required) - The content of a note

doc/api/project_snippets.md

@@ -78,7 +78,7 @@ Parameters:
 ## Delete snippet
 
 Deletes an existing project snippet. This is an idempotent function and deleting a non-existent
-snippet still returns a `200 Ok` status code.
+snippet still returns a `200 OK` status code.
 
 ```
 DELETE /projects/:id/snippets/:snippet_id

doc/api/repositories.md

@@ -10,7 +10,7 @@ GET /projects/:id/repository/tags
 
 Parameters:
 
-+ `id` (required) - The ID of a project
+- `id` (required) - The ID of a project
 
 ```json
 [
@@ -47,9 +47,9 @@ POST /projects/:id/repository/tags
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `tag_name` (required) - The name of a tag
-+ `ref` (required) - Create tag using commit SHA, another tag name, or branch name.
+- `id` (required) - The ID of a project
+- `tag_name` (required) - The name of a tag
+- `ref` (required) - Create tag using commit SHA, another tag name, or branch name.
 
 ```json
 [
@@ -81,9 +81,9 @@ GET /projects/:id/repository/tree
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `path` (optional) - The path inside repository. Used to get contend of subdirectories
-+ `ref_name` (optional) - The name of a repository branch or tag or if not given the default branch
+- `id` (required) - The ID of a project
+- `path` (optional) - The path inside repository. Used to get contend of subdirectories
+- `ref_name` (optional) - The name of a repository branch or tag or if not given the default branch
 
 ```json
 [
@@ -126,7 +126,6 @@ Parameters:
 ]
 ```
 
-
 ## Raw file content
 
 Get the raw file contents for a file by commit SHA and path.
@@ -137,10 +136,9 @@ GET /projects/:id/repository/blobs/:sha
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `sha` (required) - The commit or branch name
-+ `filepath` (required) - The path the file
-
+- `id` (required) - The ID of a project
+- `sha` (required) - The commit or branch name
+- `filepath` (required) - The path the file
 
 ## Raw blob content
 
@@ -152,22 +150,21 @@ GET /projects/:id/repository/raw_blobs/:sha
 
 Parameters:
 
-+ `id` (required) - The ID of a project
-+ `sha` (required) - The blob SHA
-
+- `id` (required) - The ID of a project
+- `sha` (required) - The blob SHA
 
 ## Get file archive
 
-Get a an archive of the repository
+Get an archive of the repository
 
 ```
 GET /projects/:id/repository/archive
 ```
 
 Parameters:
-+ `id` (required) - The ID of a project
-+ `sha` (optional) - The commit SHA to download defaults to the tip of the default branch
 
+- `id` (required) - The ID of a project
+- `sha` (optional) - The commit SHA to download defaults to the tip of the default branch
 
 ## Compare branches, tags or commits
 
@@ -176,10 +173,10 @@ GET /projects/:id/repository/compare
 ```
 
 Parameters:
-+ `id` (required) - The ID of a project
-+ `from` (required) - the commit SHA or branch name
-+ `to` (required) - the commit SHA or branch name
 
+- `id` (required) - The ID of a project
+- `from` (required) - the commit SHA or branch name
+- `to` (required) - the commit SHA or branch name
 
 ```
 GET /projects/:id/repository/compare?from=master&to=feature
@@ -230,7 +227,8 @@ GET /projects/:id/repository/contributors
 ```
 
 Parameters:
-+ `id` (required) - The ID of a project
+
+- `id` (required) - The ID of a project
 
 Response:
 

doc/api/repository_files.md

 # Repository files
 
-## CRUD for repository files
+**CRUD for repository files**
 
-## Create, read, update and delete repository files using this API
-
----
+**Create, read, update and delete repository files using this API**
 
 ## Get file from repository
 

doc/api/session.md

@@ -8,12 +8,12 @@ POST /session
 
 Parameters:
 
-+ `login` (required) - The login of user
-+ `email` (required if login missing) - The email of user
-+ `password` (required) - Valid password
+- `login` (required) - The login of user
+- `email` (required if login missing) - The email of user
+- `password` (required) - Valid password
 
+**You can login with both GitLab and LDAP credentials now**
 
-__You can login with both GitLab and LDAP credentials now__
 
 ```json
 {

doc/api/system_hooks.md

@@ -59,7 +59,7 @@ Parameters:
 
 ## Delete system hook
 
-Deletes a system hook. This is an idempotent API function and returns `200 Ok` even if the hook is not available. If the hook is deleted it is also returned as JSON.
+Deletes a system hook. This is an idempotent API function and returns `200 OK` even if the hook is not available. If the hook is deleted it is also returned as JSON.
 
 ```
 DELETE /hooks/:id

doc/api/users.md

@@ -202,7 +202,7 @@ e.g. when renaming the email address to some existing one.
 
 Deletes a user. Available only for administrators.
 This is an idempotent function, calling this function for a non-existent user id
-still returns a status code `200 Ok`.
+still returns a status code `200 OK`.
 The JSON response differs if the user was actually deleted or not.
 In the former the user is returned and in the latter not.
 
@@ -336,7 +336,7 @@ Will return created key with status `201 Created` on success, or `404 Not found`
 
 Deletes key owned by currently authenticated user.
 This is an idempotent function and calling it on a key that is already deleted
-or not available results in `200 Ok`.
+or not available results in `200 OK`.
 
 ```
 DELETE /user/keys/:id
@@ -359,4 +359,4 @@ Parameters:
 - `uid` (required) - id of specified user
 - `id` (required)  - SSH key ID
 
-Will return `200 Ok` on success, or `404 Not found` if either user or key cannot be found.
+Will return `200 OK` on success, or `404 Not found` if either user or key cannot be found.

doc/permissions/permissions.md

@@ -23,6 +23,7 @@ If a user is a GitLab administrator they receive all permissions.
 | Add tags                              |         |            | ✓           | ✓        | ✓      |
 | Write a wiki                          |         |            | ✓           | ✓        | ✓      |
 | Manage issue tracker                  |         |            | ✓           | ✓        | ✓      |
+| Manage labels                         |         |            | ✓           | ✓        | ✓      |
 | Create new milestones                 |         |            |             | ✓        | ✓      |
 | Add new team members                  |         |            |             | ✓        | ✓      |
 | Push to protected branches            |         |            |             | ✓        | ✓      |

lib/api/labels.rb

@@ -24,6 +24,7 @@ module API
       # Example Request:
       #   POST /projects/:id/labels
       post ':id/labels' do
+        authorize! :admin_label, user_project
         required_attributes! [:name, :color]
 
         attrs = attributes_for_keys [:name, :color]
@@ -51,6 +52,7 @@ module API
       # Example Request:
       #   DELETE /projects/:id/labels
       delete ':id/labels' do
+        authorize! :admin_label, user_project
         required_attributes! [:name]
 
         label = user_project.find_label(params[:name])
@@ -71,6 +73,7 @@ module API
       # Example Request:
       #   PUT /projects/:id/labels
       put ':id/labels' do
+        authorize! :admin_label, user_project
         required_attributes! [:name]
 
         label = user_project.find_label(params[:name])