When creating comments, sending different noteable IDs for target_id and
note[:noteable_id] would allow you to bypass comment creation security
if the user had creation permissions for target_id. The comment would be
created in note[:noteable_id].

Also made it so that users cannot edit/delete their comments on a
noteable that becomes unreadable to them (if it gets flagged
confidential and they don't have read access for example)

CE upstream - 2018-11-26 14:21 UTC

See merge request gitlab-org/gitlab-ee!8588

i18n: externalize strings from 'app/views/layouts'

See merge request gitlab-org/gitlab-ee!8587

# Conflicts:
#	locale/gitlab.pot

[ci skip]

[EE] i18n: externalize strings from 'app/views/shared/members'

See merge request gitlab-org/gitlab-ee!8474

Update externalized strings from `/app/views/project/runners`

See merge request gitlab-org/gitlab-ce!23347

i18n: externalize strings from 'app/views/shared/members'

See merge request gitlab-org/gitlab-ce!23125

Signed-off-by: Tao Wang <twang2218@gmail.com>

CE upstream - 2018-11-26 13:21 UTC

See merge request gitlab-org/gitlab-ee!8586

Batch load only data from same repository when lazy object is accessed

See merge request gitlab-org/gitlab-ce!23309

Signed-off-by: Tao Wang <twang2218@gmail.com>
Signed-off-by: Rémy Coutable <remy@rymai.me>

Signed-off-by: Tao Wang <twang2218@gmail.com>
Signed-off-by: Rémy Coutable <remy@rymai.me>

CE upstream - 2018-11-26 10:21 UTC

Closes gitaly#1406

See merge request gitlab-org/gitlab-ee!8582

Cache project HEAD to prevent unnecessary Gitaly calls

See merge request gitlab-org/gitlab-ce!23307

Allow to store null variables

Closes #54379

See merge request gitlab-org/gitlab-ce!23299

CE Backport: Extract Gitlab::Prometheus::QueryVariables

See merge request gitlab-org/gitlab-ce!23335

Refactor issue boards switcher to single file Vue component (CE-port)

See merge request gitlab-org/gitlab-ce!23274

Refactor issue boards switcher to single file Vue component

See merge request gitlab-org/gitlab-ee!8519

CE port for qa-193-ldap-group-sync EE branch

See merge request gitlab-org/gitlab-ce!22834

E2E QA Tests - LDAP Admin user sync and Group sync with group cn and user filter

See merge request gitlab-org/gitlab-ee!8234

Add @vue/test-utils as dev dependency

See merge request gitlab-org/gitlab-ce!23345

# Conflicts:
#	locale/gitlab.pot

[ci skip]

By specifying `key`, we get a different lazy batch loader for each
repository, which means that accessing a lazy object from one repository
will only result in that repository's objects being fetched, not those
of other repositories, saving us some unnecessary Gitaly lookups.

Externalize strings from `/app/views/project/runners`

See merge request gitlab-org/gitlab-ce!23208

Exclude qa-frontend from running on docs-only branches

See merge request gitlab-org/gitlab-ce!23327

Instruct against squashing in CE to EE MRs

See merge request gitlab-org/gitlab-ce!23330

Attempt to fix lazy loader spec transient failure

Closes #49511

See merge request gitlab-org/gitlab-ce!22918

Fix documentation on using prettier for a specific directory

See merge request gitlab-org/gitlab-ce!23336