[ci skip]

The buffering of the output may be causing issues, so let's disable it
for now.

This reverts commit a21e4112

Backport 21510 12-0-stable

See merge request gitlab/gitlabhq!3590

This reverts commit aeb730b3.

This reverts commit 3b3ce335.

[ci skip]

This reverts commit 20fe63d1.

This reverts commit 66e5d19d.

[ci skip]

Backport Reliable fetcher to 12.0

See merge request gitlab/gitlabhq!3583

backport https://gitlab.com/gitlab-org/gitlab/commit/2be136b6cdf59f4664d9fbbe91e16498a47ba227
see https://gitlab.com/gitlab-org/gitlab/commit/3baeb0c7fd6829b8c083a43370163d16f7700263
see https://gitlab.com/gitlab-org/gitlab/merge_requests/21161

[ci skip]

Set max-age and secure flag for pages auth cookies

See merge request gitlab/gitlabhq!3381

[ci skip]

Merge branch '66641-broken-master-real-http-connections-are-disabled-unregistered-request' into 'master'

Use `stub_full_request` to fix spec failure

Closes #66641

See merge request gitlab-org/gitlab-ce!32259

This reverts commit 49858350.

Return NO_ACCESS if user is nil

See merge request gitlab/gitlabhq!3388

[ci skip]

Avoid exposing unaccessible repo data upon GFM post processing

See merge request gitlab/gitlabhq!3384

When post-processing relative links to absolute links
RelativeLinkFilter didn't take into consideration that
internal repository data could be exposed for users
that do not have repository access to the project.

This commit solves that by checking whether the user
can `download_code` at this repository, avoiding any
processing of this filter if the user can't.

Additionally, if we're processing for a group (
no project was given), we check if the user can
read it in order to expand the href as an extra.
That doesn't seem necessarily a breach now,
but an extra check doesn't hurt as after all
the user needs to be able to `read_group`.

Prevent disclosure of merge request id via email

See merge request gitlab/gitlabhq!3352

Send TODOs for comments on commits correctly

See merge request gitlab/gitlabhq!3367

Require a captcha after unique failed logins from the same IP

See merge request gitlab/gitlabhq!3296

Add method to store session ids by ip

Add new specs for storing session ids

Add cleaning up records after login

Add retrieving anonymous sessions

Add login recaptcha setting

Add new setting to sessions controller

Add conditions for showing captcha

Add sessions controller specs

Add admin settings specs for login protection

Add new settings to api

Add stub to devise spec

Add new translation key

Add cr remarks

Rename class call

Add cr remarks

Change if-clause for consistency

Add cr remarks

Add code review remarks

Refactor AnonymousSession class

Add changelog entry

Move AnonymousSession class to lib

Move store unauthenticated sessions to sessions controller

Move link to recaptcha info

Regenerate text file

Improve copy on the spam page

Change action filter for storing anonymous sessions

Fix rubocop offences

Add code review remarks

Fix specs

Update schema version