Add latest changes from gitlab-org/security/gitlab@14-5-stable-ee

3 files changed, 19 insertions, 2 deletions

diff --git a/lib/api/entities/user_safe.rb b/lib/api/entities/user_safe.rb
index feb01767fd6..6006a076020 100644
--- a/lib/api/entities/user_safe.rb
+++ b/lib/api/entities/user_safe.rb
@@ -3,7 +3,17 @@
 module API
   module Entities
     class UserSafe < Grape::Entity
-      expose :id, :name, :username
+      expose :id, :username
+      expose :name do |user|
+        next user.name unless user.project_bot?
+
+        next user.name if options[:current_user]&.can?(:read_resource_access_tokens, user.projects.first)
+
+        # If the requester does not have permission to read the project bot name,
+        # the API returns an arbitrary string. UI changes will be addressed in a follow up issue:
+        # https://gitlab.com/gitlab-org/gitlab/-/issues/346058
+        '****'
+      end
     end
   end
 end
diff --git a/lib/gitlab/git_access_wiki.rb b/lib/gitlab/git_access_wiki.rb
index 0963eb6b72a..f8f61511265 100644
--- a/lib/gitlab/git_access_wiki.rb
+++ b/lib/gitlab/git_access_wiki.rb
@@ -27,6 +27,13 @@ module Gitlab
       :create_wiki
     end
 
+    override :check_download_access!
+    def check_download_access!
+      super
+
+      raise ForbiddenError, download_forbidden_message if deploy_token && !deploy_token.can?(:download_wiki_code, container)
+    end
+
     override :check_change_access!
     def check_change_access!
       raise ForbiddenError, write_to_wiki_message unless user_can_push?
diff --git a/lib/sidebars/projects/menus/analytics_menu.rb b/lib/sidebars/projects/menus/analytics_menu.rb
index b13b25d1cfe..2a89dc66219 100644
--- a/lib/sidebars/projects/menus/analytics_menu.rb
+++ b/lib/sidebars/projects/menus/analytics_menu.rb
@@ -60,7 +60,7 @@ module Sidebars
         end
 
         def repository_analytics_menu_item
-          if context.project.empty_repo?
+          if context.project.empty_repo? || !can?(context.current_user, :read_repository_graphs, context.project)
             return ::Sidebars::NilMenuItem.new(item_id: :repository_analytics)
           end