Add latest changes from gitlab-org/security/gitlab@15-7-stable-ee

5 files changed, 15 insertions, 2 deletions

diff --git a/app/controllers/projects/grafana_api_controller.rb b/app/controllers/projects/grafana_api_controller.rb
index d5099367873..9cd511f6a11 100644
--- a/app/controllers/projects/grafana_api_controller.rb
+++ b/app/controllers/projects/grafana_api_controller.rb
@@ -4,6 +4,8 @@ class Projects::GrafanaApiController < Projects::ApplicationController
   include RenderServiceResults
   include MetricsDashboard
 
+  before_action :authorize_read_grafana!, only: :proxy
+
   feature_category :metrics
   urgency :low
 
diff --git a/app/policies/project_policy.rb b/app/policies/project_policy.rb
index 7f67e80e432..2a13fafa313 100644
--- a/app/policies/project_policy.rb
+++ b/app/policies/project_policy.rb
@@ -308,6 +308,8 @@ class ProjectPolicy < BasePolicy
   rule { guest & can?(:download_code) }.enable :build_download_code
   rule { guest & can?(:read_container_image) }.enable :build_read_container_image
 
+  rule { guest & ~public_project }.enable :read_grafana
+
   rule { can?(:reporter_access) }.policy do
     enable :admin_issue_board
     enable :download_code
@@ -340,6 +342,7 @@ class ProjectPolicy < BasePolicy
     enable :read_package
     enable :read_product_analytics
     enable :read_ci_cd_analytics
+    enable :read_grafana
   end
 
   # We define `:public_user_access` separately because there are cases in gitlab-ee
diff --git a/app/services/users/update_service.rb b/app/services/users/update_service.rb
index cb2711b6fee..96018db5974 100644
--- a/app/services/users/update_service.rb
+++ b/app/services/users/update_service.rb
@@ -31,6 +31,7 @@ module Users
 
       assign_identity
       build_canonical_email
+      reset_unconfirmed_email
 
       if @user.save(validate: validate) && update_status
         notify_success(user_exists)
@@ -64,6 +65,13 @@ module Users
       Users::UpdateCanonicalEmailService.new(user: @user).execute
     end
 
+    def reset_unconfirmed_email
+      return unless @user.persisted?
+      return unless @user.email_changed?
+
+      @user.update_column(:unconfirmed_email, nil)
+    end
+
     def update_status
       return true unless @status_params
 
diff --git a/app/views/devise/mailer/_confirmation_instructions_account.html.haml b/app/views/devise/mailer/_confirmation_instructions_account.html.haml
index 9d469ff6e7b..c1655818770 100644
--- a/app/views/devise/mailer/_confirmation_instructions_account.html.haml
+++ b/app/views/devise/mailer/_confirmation_instructions_account.html.haml
@@ -1,7 +1,7 @@
 - confirmation_link = confirmation_url(@resource, confirmation_token: @token)
 - if @resource.unconfirmed_email.present? || !@resource.created_recently?
   #content
-    = email_default_heading(@resource.unconfirmed_email || @resource.email)
+    = email_default_heading(@email)
     %p= _('Click the link below to confirm your email address.')
     #cta
       = link_to _('Confirm your email address'), confirmation_link
diff --git a/app/views/devise/mailer/_confirmation_instructions_account.text.erb b/app/views/devise/mailer/_confirmation_instructions_account.text.erb
index e6da78e3a3d..7e4f38885f6 100644
--- a/app/views/devise/mailer/_confirmation_instructions_account.text.erb
+++ b/app/views/devise/mailer/_confirmation_instructions_account.text.erb
@@ -1,5 +1,5 @@
 <% if @resource.unconfirmed_email.present? || !@resource.created_recently? %>
-<%= @resource.unconfirmed_email || @resource.email %>,
+<%= @email %>,
 <%= _('Use the link below to confirm your email address.') %>
 <% else %>
   <% if Gitlab.com? %>