Add latest changes from gitlab-org/security/gitlab@16-4-stable-ee

8 files changed, 34 insertions, 12 deletions

diff --git a/app/assets/javascripts/behaviors/markdown/render_math.js b/app/assets/javascripts/behaviors/markdown/render_math.js
index b2348cf0bad..7525fc76d16 100644
--- a/app/assets/javascripts/behaviors/markdown/render_math.js
+++ b/app/assets/javascripts/behaviors/markdown/render_math.js
@@ -66,16 +66,12 @@ class SafeMathRenderer {
     el.removeAttribute('style');
     if (!forceRender && (this.totalMS >= MAX_RENDER_TIME_MS || text.length > MAX_MATH_CHARS)) {
       // Show unrendered math code
-      const wrapperElement = document.createElement('div');
       const codeElement = document.createElement('pre');
 
       codeElement.className = 'code';
       codeElement.textContent = el.textContent;
       codeElement.dataset.mathStyle = el.dataset.mathStyle;
 
-      const { parentNode } = el;
-      parentNode.replaceChild(wrapperElement, el);
-
       let message;
       if (text.length > MAX_MATH_CHARS) {
         message = sprintf(
@@ -103,11 +99,11 @@ class SafeMathRenderer {
           </div>
           `;
 
-      if (!wrapperElement.classList.contains('lazy-alert-shown')) {
+      if (!el.classList.contains('lazy-alert-shown')) {
         // eslint-disable-next-line no-unsanitized/property
-        wrapperElement.innerHTML = html;
-        wrapperElement.append(codeElement);
-        wrapperElement.classList.add('lazy-alert-shown');
+        el.innerHTML = html;
+        el.append(codeElement);
+        el.classList.add('lazy-alert-shown');
       }
 
       // Render the next math
@@ -125,6 +121,12 @@ class SafeMathRenderer {
       }
 
       try {
+        if (displayContainer.dataset.mathStyle === 'inline') {
+          displayContainer.classList.add('math-content-inline');
+        } else {
+          displayContainer.classList.add('math-content-display');
+        }
+
         // eslint-disable-next-line no-unsanitized/property
         displayContainer.innerHTML = this.katex.renderToString(text, {
           displayMode: el.dataset.mathStyle === 'display',
@@ -169,8 +171,7 @@ class SafeMathRenderer {
   render() {
     // Replace math blocks with a placeholder so they aren't rendered twice
     this.elements.forEach((el) => {
-      const placeholder = document.createElement('span');
-      placeholder.style.display = 'none';
+      const placeholder = document.createElement('div');
       placeholder.dataset.mathStyle = el.dataset.mathStyle;
       placeholder.textContent = el.textContent;
       el.parentNode.replaceChild(placeholder, el);
diff --git a/app/assets/stylesheets/framework/markdown_area.scss b/app/assets/stylesheets/framework/markdown_area.scss
index b87fd3e67d4..62782de5402 100644
--- a/app/assets/stylesheets/framework/markdown_area.scss
+++ b/app/assets/stylesheets/framework/markdown_area.scss
@@ -137,6 +137,16 @@
   border-radius: $border-radius-default $border-radius-default 0 0;
 }
 
+.math-content-inline {
+  overflow: auto;
+  display: inline-flex;
+}
+
+.math-content-display {
+  overflow: auto;
+  display: block;
+}
+
 @include media-breakpoint-down(xs) {
   .referenced-users {
     margin-right: 0;
diff --git a/app/controllers/projects/error_tracking/projects_controller.rb b/app/controllers/projects/error_tracking/projects_controller.rb
index 531bd327e43..372fbfdc183 100644
--- a/app/controllers/projects/error_tracking/projects_controller.rb
+++ b/app/controllers/projects/error_tracking/projects_controller.rb
@@ -5,7 +5,7 @@ module Projects
     class ProjectsController < Projects::ApplicationController
       respond_to :json
 
-      before_action :authorize_read_sentry_issue!
+      before_action :authorize_admin_sentry!
 
       feature_category :error_tracking
       urgency :low
diff --git a/app/helpers/merge_requests_helper.rb b/app/helpers/merge_requests_helper.rb
index a90a16e120c..06eb3fcc233 100644
--- a/app/helpers/merge_requests_helper.rb
+++ b/app/helpers/merge_requests_helper.rb
@@ -133,6 +133,8 @@ module MergeRequestsHelper
       _('Not available for private projects')
     elsif ProtectedBranch.protected?(merge_request.source_project, merge_request.source_branch)
       _('Not available for protected branches')
+    elsif !merge_request.author.can?(:push_code, merge_request.source_project)
+      _('Merge request author cannot push to target project')
     end
   end
 
diff --git a/app/models/project.rb b/app/models/project.rb
index 68196f0a757..5989584ce43 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -3456,6 +3456,7 @@ class Project < ApplicationRecord
       # Issue for N+1: https://gitlab.com/gitlab-org/gitlab-foss/issues/49322
       Gitlab::GitalyClient.allow_n_plus_1_calls do
         merge_requests_allowing_collaboration(branch_name).any? do |merge_request|
+          merge_request.author.can?(:push_code, self) &&
           merge_request.can_be_merged_by?(user, skip_collaboration_check: true)
         end
       end
diff --git a/app/models/project_team.rb b/app/models/project_team.rb
index 34754f4fc95..38521ae6090 100644
--- a/app/models/project_team.rb
+++ b/app/models/project_team.rb
@@ -121,7 +121,7 @@ class ProjectTeam
   def import(source_project, current_user)
     target_project = project
 
-    source_members = source_project.project_members.to_a
+    source_members = source_members_for_import(source_project)
     target_user_ids = target_project.project_members.pluck_user_ids
 
     importer_access_level = max_member_access(current_user.id)
@@ -242,6 +242,10 @@ class ProjectTeam
   def member_user_ids
     Member.on_project_and_ancestors(project).select(:user_id)
   end
+
+  def source_members_for_import(source_project)
+    source_project.project_members.to_a
+  end
 end
 
 ProjectTeam.prepend_mod_with('ProjectTeam')
diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb
index 38e6360f81d..a57b6f8daf7 100644
--- a/app/policies/project_policy.rb
+++ b/app/policies/project_policy.rb
@@ -289,6 +289,7 @@ class ProjectPolicy < BasePolicy
     enable :change_visibility_level
     enable :remove_project
     enable :archive_project
+    enable :link_forked_project
     enable :remove_fork_project
     enable :destroy_merge_request
     enable :destroy_issue
@@ -545,6 +546,7 @@ class ProjectPolicy < BasePolicy
     enable :destroy_release
     enable :destroy_artifacts
     enable :admin_operations
+    enable :admin_sentry
     enable :read_deploy_token
     enable :create_deploy_token
     enable :destroy_deploy_token
diff --git a/app/services/error_tracking/list_projects_service.rb b/app/services/error_tracking/list_projects_service.rb
index 1539e24df9d..67d690d64e7 100644
--- a/app/services/error_tracking/list_projects_service.rb
+++ b/app/services/error_tracking/list_projects_service.rb
@@ -5,6 +5,8 @@ module ErrorTracking
     private
 
     def perform
+      return error('Access denied', :unauthorized) unless can?(current_user, :admin_sentry, project)
+
       unless project_error_tracking_setting.valid?
         return error(project_error_tracking_setting.errors.full_messages.join(', '), :bad_request)
       end