Merge branch '11-8-stable-patch-2' into '11-8-stable'

Prepare 11.8.2 release

See merge request gitlab-org/gitlab-ce!25963

23 files changed, 147 insertions, 30 deletions

diff --git a/app/assets/javascripts/vue_merge_request_widget/mr_widget_options.vue b/app/assets/javascripts/vue_merge_request_widget/mr_widget_options.vue
index abbbe19c5ef..57c4dfbe3b7 100644
--- a/app/assets/javascripts/vue_merge_request_widget/mr_widget_options.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/mr_widget_options.vue
@@ -315,7 +315,7 @@ export default {
         :endpoint="mr.testResultsPath"
       />
 
-      <div class="mr-widget-section p-0">
+      <div class="mr-widget-section">
         <component :is="componentName" :mr="mr" :service="service" />
 
         <section v-if="shouldRenderCollaborationStatus" class="mr-info-list mr-links">
diff --git a/app/assets/stylesheets/pages/merge_requests.scss b/app/assets/stylesheets/pages/merge_requests.scss
index 790d438c7e2..5624ac5192d 100644
--- a/app/assets/stylesheets/pages/merge_requests.scss
+++ b/app/assets/stylesheets/pages/merge_requests.scss
@@ -82,7 +82,6 @@
 }
 
 .mr-widget-body,
-.mr-widget-section,
 .mr-widget-content,
 .mr-widget-footer {
   padding: $gl-padding;
diff --git a/app/models/project.rb b/app/models/project.rb
index 8f746f6e094..daa018d6f89 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -1830,7 +1830,7 @@ class Project < ActiveRecord::Base
   # Set repository as writable again
   def set_repository_writable!
     with_lock do
-      update_column(repository_read_only, false)
+      update_column(:repository_read_only, false)
     end
   end
 
diff --git a/app/policies/group_policy.rb b/app/policies/group_policy.rb
index c25766a5af8..298769c0eb8 100644
--- a/app/policies/group_policy.rb
+++ b/app/policies/group_policy.rb
@@ -54,6 +54,7 @@ class GroupPolicy < BasePolicy
 
   rule { has_projects }.policy do
     enable :read_group
+    enable :read_list
     enable :read_label
   end
 
diff --git a/changelogs/unreleased/57579-gitlab-project-import-fails-sidekiq-undefined-method-import_jid.yml b/changelogs/unreleased/57579-gitlab-project-import-fails-sidekiq-undefined-method-import_jid.yml
new file mode 100644
index 00000000000..f7d6a6c4863
--- /dev/null
+++ b/changelogs/unreleased/57579-gitlab-project-import-fails-sidekiq-undefined-method-import_jid.yml
@@ -0,0 +1,5 @@
+---
+title: Fix import_jid error on project import
+merge_request: 25239
+author:
+type: fixed
diff --git a/changelogs/unreleased/58149-fix-read-list-board-policy.yml b/changelogs/unreleased/58149-fix-read-list-board-policy.yml
new file mode 100644
index 00000000000..964813f4c9a
--- /dev/null
+++ b/changelogs/unreleased/58149-fix-read-list-board-policy.yml
@@ -0,0 +1,6 @@
+---
+title: Fix error when viewing group issue boards when user doesn't have explicit group
+  permissions
+merge_request: 25524
+author:
+type: fixed
diff --git a/changelogs/unreleased/jc-fix-set-project-writable.yml b/changelogs/unreleased/jc-fix-set-project-writable.yml
new file mode 100644
index 00000000000..0bfd90c3967
--- /dev/null
+++ b/changelogs/unreleased/jc-fix-set-project-writable.yml
@@ -0,0 +1,5 @@
+---
+title: Fix method to mark a project repository as writable
+merge_request: 25546
+author:
+type: fixed
diff --git a/changelogs/unreleased/sh-fix-issue-58103.yml b/changelogs/unreleased/sh-fix-issue-58103.yml
new file mode 100644
index 00000000000..1599af23fed
--- /dev/null
+++ b/changelogs/unreleased/sh-fix-issue-58103.yml
@@ -0,0 +1,5 @@
+---
+title: Properly handle multiple X-Forwarded-For addresses in runner IP
+merge_request: 25511
+author:
+type: fixed
diff --git a/doc/administration/index.md b/doc/administration/index.md
index 12fec2753bf..683c4921f37 100644
--- a/doc/administration/index.md
+++ b/doc/administration/index.md
@@ -48,7 +48,7 @@ Learn how to install, configure, update, and maintain your GitLab instance.
 - [Third party offers](../user/admin_area/settings/third_party_offers.md)
 - [Compliance](compliance.md): A collection of features from across the application that you may configure to help ensure that your GitLab instance and DevOps workflow meet compliance standards.
 - [Diff limits](../user/admin_area/diff_limits.md): Configure the diff rendering size limits of branch comparison pages.
-- [Merge request diffs](merge_request_diffs.md): Configure the diffs shown on merge requests
+- [Merge request diffs storage](merge_request_diffs.md): Configure merge requests diffs external storage.
 - [Broadcast Messages](../user/admin_area/broadcast_messages.md): Send messages to GitLab users through the UI.
 
 #### Customizing GitLab's appearance
diff --git a/doc/administration/merge_request_diffs.md b/doc/administration/merge_request_diffs.md
index 94620c3d3a0..c34a9519ace 100644
--- a/doc/administration/merge_request_diffs.md
+++ b/doc/administration/merge_request_diffs.md
@@ -1,7 +1,6 @@
-# Merge request diffs administration
+# Merge request diffs storage **[CORE ONLY]**
 
-> **Notes:**
-> - External merge request diffs introduced in GitLab 11.8
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/issues/52568) in GitLab 11.8.
 
 Merge request diffs are size-limited copies of diffs associated with merge
 requests. When viewing a merge request, diffs are sourced from these copies
@@ -16,9 +15,7 @@ large, in which case, switching to external storage is recommended.
 Merge request diffs can be stored on disk, or in object storage. In general, it
 is better to store the diffs in the database than on disk.
 
-To enable external storage of merge request diffs:
-
----
+To enable external storage of merge request diffs, follow the instructions below.
 
 **In Omnibus installations:**
 
@@ -29,17 +26,15 @@ To enable external storage of merge request diffs:
     ```
 
 1. _The external diffs will be stored in in
-   `/var/opt/gitlab/gitlab-rails/shared/external-diffs`._  To change the path,
-   for example to `/mnt/storage/external-diffs`, edit `/etc/gitlab/gitlab.rb`
+   `/var/opt/gitlab/gitlab-rails/shared/external-diffs`._ To change the path,
+   for example, to `/mnt/storage/external-diffs`, edit `/etc/gitlab/gitlab.rb`
    and add the following line:
 
     ```ruby
     gitlab_rails['external_diffs_storage_path'] = "/mnt/storage/external-diffs"
     ```
 
-1. Save the file and [reconfigure GitLab][] for the changes to take effect.
-
----
+1. Save the file and [reconfigure GitLab](restart_gitlab.md#omnibus-gitlab-reconfigure) for the changes to take effect.
 
 **In installations from source:**
 
@@ -52,7 +47,7 @@ To enable external storage of merge request diffs:
     ```
 
 1. _The external diffs will be stored in 
-   `/home/git/gitlab/shared/external-diffs`._ To change the path,  for example
+   `/home/git/gitlab/shared/external-diffs`._ To change the path, for example,
    to `/mnt/storage/external-diffs`, edit `/home/git/gitlab/config/gitlab.yml`
    and add or amend the following lines:
 
@@ -62,18 +57,18 @@ To enable external storage of merge request diffs:
       storage_path: /mnt/storage/external-diffs
     ```
 
-1. Save the file and [restart GitLab][] for the changes to take effect.
+1. Save the file and [restart GitLab](restart_gitlab.md#installations-from-source) for the changes to take effect.
 
 ### Using object storage
 
-Instead of storing the external diffs on disk, we recommended you use an object
+Instead of storing the external diffs on disk, we recommended the use of an object
 store like AWS S3 instead. This configuration relies on valid AWS credentials to
 be configured already.
 
 ### Object Storage Settings
 
 For source installations, these settings are nested under `external_diffs:` and
-then `object_store:`. On omnibus installs, they are prefixed by
+then `object_store:`. On Omnibus installations, they are prefixed by
 `external_diffs_object_store_`.
 
 | Setting | Description | Default |
@@ -118,7 +113,7 @@ The connection settings match those provided by [Fog](https://github.com/fog), a
     }
     ```
 
-    NOTE: if you are using AWS IAM profiles, be sure to omit the
+    Note that, if you are using AWS IAM profiles, be sure to omit the
     AWS access key and secret access key/value pairs. For example:
 
     ```ruby
@@ -129,9 +124,7 @@ The connection settings match those provided by [Fog](https://github.com/fog), a
     }
     ```
 
-1. Save the file and [reconfigure GitLab][] for the changes to take effect.
-
----
+1. Save the file and [reconfigure GitLab](restart_gitlab.md#omnibus-gitlab-reconfigure) for the changes to take effect.
 
 **In installations from source:**
 
@@ -151,4 +144,4 @@ The connection settings match those provided by [Fog](https://github.com/fog), a
           region: eu-central-1
     ```
 
-1. Save the file and [restart GitLab][] for the changes to take effect.
+1. Save the file and [restart GitLab](restart_gitlab.md#installations-from-source) for the changes to take effect.
diff --git a/doc/install/requirements.md b/doc/install/requirements.md
index 1b7e0d1d0ab..c1f2297f3be 100644
--- a/doc/install/requirements.md
+++ b/doc/install/requirements.md
@@ -33,7 +33,7 @@ Please consider using a virtual machine to run GitLab.
 
 ## Ruby versions
 
-GitLab requires Ruby (MRI) 2.3. Support for Ruby versions below 2.3 (2.1, 2.2) will stop with GitLab 8.13.
+GitLab requires Ruby (MRI) 2.5. Support for Ruby versions below 2.5 (2.3, 2.4) will stop with GitLab 11.6.
 
 You will have to use the standard MRI implementation of Ruby.
 We love [JRuby](https://www.jruby.org/) and [Rubinius](https://rubinius.com) but GitLab
diff --git a/lib/api/helpers/runner.rb b/lib/api/helpers/runner.rb
index 16df8e830e1..ff73a49d5e8 100644
--- a/lib/api/helpers/runner.rb
+++ b/lib/api/helpers/runner.rb
@@ -26,7 +26,7 @@ module API
       end
 
       def get_runner_ip
-        { ip_address: request.env["HTTP_X_FORWARDED_FOR"] || request.ip }
+        { ip_address: env["action_dispatch.remote_ip"].to_s || request.ip }
       end
 
       def current_runner
diff --git a/lib/gitlab/import_export/shared.rb b/lib/gitlab/import_export/shared.rb
index 947caaaefee..725c1101d70 100644
--- a/lib/gitlab/import_export/shared.rb
+++ b/lib/gitlab/import_export/shared.rb
@@ -61,7 +61,7 @@ module Gitlab
       def log_base_data
         {
           importer: 'Import/Export',
-          import_jid: @project&.import_state&.import_jid,
+          import_jid: @project&.import_state&.jid,
           project_id: @project&.id,
           project_path: @project&.full_path
         }
diff --git a/qa/Gemfile b/qa/Gemfile
index 873eac1013f..f29006617ed 100644
--- a/qa/Gemfile
+++ b/qa/Gemfile
@@ -8,3 +8,4 @@ gem 'rspec', '~> 3.7'
 gem 'selenium-webdriver', '~> 3.12'
 gem 'airborne', '~> 0.2.13'
 gem 'nokogiri', '~> 1.10.1'
+gem 'rspec-retry', '~> 0.6.1'
diff --git a/qa/Gemfile.lock b/qa/Gemfile.lock
index 9f84bdc3828..c3d9f558c23 100644
--- a/qa/Gemfile.lock
+++ b/qa/Gemfile.lock
@@ -76,6 +76,8 @@ GEM
     rspec-mocks (3.7.0)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.7.0)
+    rspec-retry (0.6.1)
+      rspec-core (> 3.3)
     rspec-support (3.7.0)
     rubyzip (1.2.2)
     selenium-webdriver (3.141.0)
@@ -101,6 +103,7 @@ DEPENDENCIES
   pry-byebug (~> 3.5.1)
   rake (~> 12.3.0)
   rspec (~> 3.7)
+  rspec-retry (~> 0.6.1)
   selenium-webdriver (~> 3.12)
 
 BUNDLED WITH
diff --git a/qa/qa/specs/features/browser_ui/3_create/repository/push_mirroring_over_http_spec.rb b/qa/qa/specs/features/browser_ui/3_create/repository/push_mirroring_over_http_spec.rb
index 9d31a25ab35..208c45e7a65 100644
--- a/qa/qa/specs/features/browser_ui/3_create/repository/push_mirroring_over_http_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/repository/push_mirroring_over_http_spec.rb
@@ -1,7 +1,8 @@
 # frozen_string_literal: true
 
 module QA
-  context 'Create' do
+  # https://gitlab.com/gitlab-org/quality/staging/issues/40
+  context 'Create', :quarantine do
     describe 'Push mirror a repository over HTTP' do
       it 'configures and syncs a (push) mirrored repository' do
         Runtime::Browser.visit(:gitlab, Page::Main::Login)
diff --git a/qa/spec/spec_helper.rb b/qa/spec/spec_helper.rb
index cddaa6fc6e0..021fe5fce5e 100644
--- a/qa/spec/spec_helper.rb
+++ b/qa/spec/spec_helper.rb
@@ -1,4 +1,5 @@
 require_relative '../qa'
+require 'rspec/retry'
 
 Dir[::File.join(__dir__, 'support', '**', '*.rb')].each { |f| require f }
 
@@ -43,6 +44,17 @@ RSpec.configure do |config|
   config.profile_examples = 10
   config.order = :random
   Kernel.srand config.seed
+
+  # show retry status in spec process
+  config.verbose_retry = true
+
+  # show exception that triggers a retry if verbose_retry is set to true
+  config.display_try_failure_messages = true
+
+  config.around do |example|
+    retry_times = example.metadata.keys.include?(:quarantine) ? 1 : 3
+    example.run_with_retry retry: retry_times
+  end
 end
 
 # Skip tests in quarantine unless we explicitly focus on them.
diff --git a/qa/spec/spec_helper_spec.rb b/qa/spec/spec_helper_spec.rb
index 2427999e110..27ec1ec80fe 100644
--- a/qa/spec/spec_helper_spec.rb
+++ b/qa/spec/spec_helper_spec.rb
@@ -28,6 +28,22 @@ describe 'rspec config tests' do
     end
   end
 
+  let(:group_2) do
+    RSpec.describe do
+      before(:all) do
+        @expectations = [1, 2, 3]
+      end
+
+      example 'not in quarantine' do
+        expect(@expectations.shift).to be(3)
+      end
+
+      example 'in quarantine', :quarantine do
+        expect(@expectations.shift).to be(3)
+      end
+    end
+  end
+
   context 'with no tags focussed' do
     before do
       group.run
@@ -301,4 +317,39 @@ describe 'rspec config tests' do
       end
     end
   end
+
+  context 'rspec retry' do
+    context 'in an untagged context' do
+      before do
+        group_2.run
+      end
+
+      it 'should run example :retry times' do
+        examples = group_2.descendant_filtered_examples
+        ex = examples.find { |e| e.description == 'not in quarantine' }
+        expect(ex.execution_result.status).to eq(:passed)
+      end
+    end
+
+    context 'with :quarantine focussed' do
+      before do
+        RSpec.configure do |config|
+          config.inclusion_filter = :quarantine
+        end
+        group_2.run
+      end
+
+      after do
+        RSpec.configure do |config|
+          config.inclusion_filter.clear
+        end
+      end
+
+      it 'should run example once only' do
+        examples = group_2.descendant_filtered_examples
+        ex = examples.find { |e| e.description == 'in quarantine' }
+        expect(ex.execution_result.status).to eq(:failed)
+      end
+    end
+  end
 end
diff --git a/spec/lib/gitlab/import_export/shared_spec.rb b/spec/lib/gitlab/import_export/shared_spec.rb
index f2d750c6595..2c288cff6ef 100644
--- a/spec/lib/gitlab/import_export/shared_spec.rb
+++ b/spec/lib/gitlab/import_export/shared_spec.rb
@@ -14,6 +14,16 @@ describe Gitlab::ImportExport::Shared do
       expect(subject.errors).to eq(['Error importing into [FILTERED] Permission denied @ unlink_internal - [FILTERED]'])
     end
 
+    it 'updates the import JID' do
+      import_state = create(:import_state, project: project, jid: 'jid-test')
+
+      expect_next_instance_of(Gitlab::Import::Logger) do |logger|
+        expect(logger).to receive(:error).with(hash_including(import_jid: import_state.jid))
+      end
+
+      subject.error(error)
+    end
+
     it 'calls the error logger with the full message' do
       expect(subject).to receive(:log_error).with(hash_including(message: error.message))
 
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index c1767ed0535..851b796c731 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -2487,6 +2487,16 @@ describe Project do
     end
   end
 
+  describe '#set_repository_writable!' do
+    it 'sets repository_read_only to false' do
+      project = create(:project, :read_only)
+
+      expect { project.set_repository_writable! }
+        .to change(project, :repository_read_only)
+        .from(true).to(false)
+    end
+  end
+
   describe '#pushes_since_gc' do
     let(:project) { create(:project) }
 
diff --git a/spec/policies/group_policy_spec.rb b/spec/policies/group_policy_spec.rb
index be1804c5ce0..af6d6f084a9 100644
--- a/spec/policies/group_policy_spec.rb
+++ b/spec/policies/group_policy_spec.rb
@@ -83,7 +83,7 @@ describe GroupPolicy do
     end
 
     it do
-      expect_allowed(:read_group, :read_label)
+      expect_allowed(:read_group, :read_list, :read_label)
     end
 
     context 'in subgroups', :nested_groups do
@@ -91,7 +91,7 @@ describe GroupPolicy do
       let(:project) { create(:project, namespace: subgroup) }
 
       it do
-        expect_allowed(:read_group, :read_label)
+        expect_allowed(:read_group, :read_list, :read_label)
       end
     end
   end
diff --git a/spec/requests/api/runner_spec.rb b/spec/requests/api/runner_spec.rb
index d7ddd97e8c8..91981f7c56a 100644
--- a/spec/requests/api/runner_spec.rb
+++ b/spec/requests/api/runner_spec.rb
@@ -526,6 +526,15 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
             expect(runner.reload.ip_address).to eq('123.222.123.222')
           end
 
+          it "handles multiple X-Forwarded-For addresses" do
+            post api('/jobs/request'),
+              params: { token: runner.token },
+              headers: { 'User-Agent' => user_agent, 'X-Forwarded-For' => '123.222.123.222, 127.0.0.1' }
+
+            expect(response).to have_gitlab_http_status 201
+            expect(runner.reload.ip_address).to eq('123.222.123.222')
+          end
+
           context 'when concurrently updating a job' do
             before do
               expect_any_instance_of(Ci::Build).to receive(:run!)
diff --git a/spec/views/projects/issues/_merge_requests_status.html.haml_spec.rb b/spec/views/projects/issues/_merge_requests_status.html.haml_spec.rb
index 02c225292ce..9424795749d 100644
--- a/spec/views/projects/issues/_merge_requests_status.html.haml_spec.rb
+++ b/spec/views/projects/issues/_merge_requests_status.html.haml_spec.rb
@@ -2,6 +2,12 @@
 require 'spec_helper'
 
 describe 'projects/issues/_merge_requests_status.html.haml' do
+  around do |ex|
+    Timecop.freeze(Date.new(2018, 7, 22)) do
+      ex.run
+    end
+  end
+
   it 'shows date of status change in tooltip' do
     merge_request = create(:merge_request, created_at: 1.month.ago)