https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5142#note_14347679
https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5142#note_14347470

https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5142#note_14347729

https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5142/diffs#note_14347758

https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5142#note_14073464

* upstream/master: (195 commits)
  Fix expansion of discussions in diff
  Improve performance of MR show page
  Fix jumping between discussions on changes tab
  Update doorkeeper to 4.2.0
  Fix MR note discussion ID
  Handle legacy sort order values
  Refactor `find_for_git_client` and its related methods.
  Remove right margin on Jump button icon
  Fix bug causing “Jump to discussion” button not to show
  Small refactor and syntax fixes.
  Removed unnecessary service for user retrieval and improved API error message.
  Added documentation and CHANGELOG item
  Added checks for 2FA to the API `/sessions` endpoint and the Resource Owner Password Credentials flow.
  Fix behavior around commands with optional arguments
  Fix behavior of label_ids and add/remove_label_ids
  Remove unneeded aliases
  Do not expose projects on deployments
  Incorporate feedback
  Docs for API endpoints
  Expose project for environments
  ...

Fix same tiny grammar mistake as in ee

This is a tiny grammar fix that was already merged into EE

https://gitlab.com/gitlab-org/gitlab-ee/merge_requests/667#note_14043471

See merge request !5865

Diff line comments resolve

## What does this MR do?

Diff line comments can be resolved.

Part of #10325 

To do:

- [x] Backend (@DouweM)
  - [x] Fix https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5022#note_13319326. Will be made easier by https://gitlab.com/gitlab-org/gitlab-ce/issues/17237#note_13370331
  - [x] System note when all discussions are resolved
  - [x] Notification when all discussions are resolved
  - [x] Write unit tests
  - [x] Look at resolve time https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5022#note_13912743 - Fixed by 4a13aa9f
- [x] Frontend (@iamphill)
  - [x] Fix bugs
  - [x] Write more feature tests 
- [x] Frontend (@connorshea)
  - [x] Address frontend feedback
  - [x] Feature specs for Jump feature
  - [x] Documentation
  - [x] Add Vue.js in a standard way

See merge request !5022

Update doorkeeper to 4.2.0

Changelog: https://git.io/v6PnV

See merge request !5881

2FA checks for Git over HTTP

## What does this MR do?

This MR allows the use of `PersonalAccessTokens` to access Git over HTTP and makes that the only allowed method if the user has 2FA enabled. If a user with 2FA enabled tries to access Git over HTTP using his username and password the request will be denied and the user will be presented with the following message:

```
remote: HTTP Basic: Access denied
remote: You have 2FA enabled, please use a personal access token for Git over HTTP.
remote: You can generate one at http://localhost:3000/profile/personal_access_tokens
fatal: Authentication failed for 'http://localhost:3000/documentcloud/underscore.git/'
```

## What are the relevant issue numbers?

Fixes #13568 

See merge request !5764

Changelog: https://git.io/v6PnV

Handle legacy sort order values

Convert the legacy sort order values id_asc / id_desc into the ones we use now, created_at / created_desc, to stop the dropdown being blank.

Closes #21028.

See merge request !5880

2FA checks for API workflows

## What does this MR do?

It adds a check to the API `/session` endpoint that will deny authentication requests to users that have 2FA enabled. In the error message it will instruct them to use a Personal Access Token instead.

It adds a check to the `/oauth/token` endpoint, when `grant_type: 'password'` is used, so that no OAuth2 access token can be generated if the user has 2FA enabled. This endpoint should not be used by OAuth applications, anyway. OAuth apps should follow the flow of redirecting the user to GitLab, where 2FA access restrictions apply and logging them in there. Once successfully authenticated, the OAuth token is passed to the client.

## Why was this MR needed?

No 2FA check on API endpoints.

## What are the relevant issue numbers?

Fixes #2979

See merge request !5820

Update Hamlit to 2.6.1

Fixes gitlab-org/gitlab-ce#21025 and gitlab-org/gitlab-ce#21017

See merge request !5873

The sort orders used to be id_asc / id_desc, and are now created_asc /
created_desc. Users can still have cookies containing the old sort
orders, or bookmarks to links specifying them, so convert these to the
new versions quietly.

Added checks for 2FA to the API `/sessions` endpoint and the Resource Owner Password Credentials flow.

# Conflicts:
#	db/schema.rb

Support slash commands in issues / MR description & comments

See merge request !5021

Merge branch '3225-ace-editor-causing-404-errors-every-time-you-try-to-edit-a-file-in-the-webui' into 'master'

Fix Ace syntax highlighting with compiled assets

## What does this MR do?

Update ACE to 4.1.0 to allow modes (syntax highlighting files for particular languages) to be lazily loaded.

## Are there points in the code the reviewer needs to double check?

Don't think so.

## Why was this MR needed?

Syntax highlighting in the file editor only worked in development and test modes, not in production!

## What are the relevant issue numbers?

Closes #3225.

## Screenshots (if relevant)

First, the test setup - add these lines to `development.rb`:
```ruby
  config.assets.debug = false
  config.assets.compile = false
  config.assets.digest = true
```

Then, before starting the server, run `bundle exec rake assets:clobber assets:precompile`.

Before:

![image](/uploads/486198e273019f8969d2e90560d82928/image.png)

There is an error in the console because `/assets/ace/mode-ruby.js` was not found (it's only available when assets are compiled on demand).

After:

![image](/uploads/6aa0d69b7efdfd6fe6aa22b9a49e9716/image.png)

This loads `/assets/ace/mode-ruby-3915f95a6cc47306b1305e4dcb7aca25b2ef9c49b18ec6011707135b6575d8f3.js`, which works because the precompile step included it and told ACE where to find it.

## Does this MR meet the acceptance criteria?

- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- ~~[Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)~~
- ~~API support added~~
- Tests
  - ~~Added for this feature/bug~~
  - [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !5501

Abuse Reports message truncation

## What does this MR do?

Adds dynamic message truncation to abuse reports

## Are there points in the code the reviewer needs to double check?

Is the new UI OK?

## Why was this MR needed?

Admin UX

## What are the relevant issue numbers?

Closes #13664.

## Screenshots (if relevant)

**UPDATED:**

![Screen_Shot_2016-07-07_at_03.02.43](/uploads/2e1a1122e0194f8ffa48054c18523ccd/Screen_Shot_2016-07-07_at_03.02.43.png)

## Does this MR meet the acceptance criteria?

- [ ] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [ ] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [ ] API support added
- Tests
  - [ ] Added for this feature/bug
  - [ ] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)
Closes #13664

See merge request !5032

Truncated long user lists in award emoji tooltips

## What does this MR do?
Truncates award emoji tooltips so that they only show 10 users maximum.

Further users are indicated by appending "and X more."

## Are there points in the code the reviewer needs to double check?
Is 10 too little, should it be raised?

My test cases rely on join() to build the expected output.
This feels a little iffy is it alright?

## Why was this MR needed?
Some issues have a large number of thumbs causing tooltips to be very large.

## What are the relevant issue numbers?
closes #18334, closes #19542

## Screenshots (if relevant)
##### Before
![Screenshot_from_2016-06-20_19-49-12](/uploads/d7a14dd87bb3da2acd7c0818de99852b/Screenshot_from_2016-06-20_19-49-12.png)

##### After
![Screenshot_from_2016-06-20_19-50-58](/uploads/f7f05c44594bfe8cec7dfd48802753a6/Screenshot_from_2016-06-20_19-50-58.png)

Truncation point modified for purposes of screenshot

## Does this MR meet the acceptance criteria?

- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [x] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md)
- [x] API support added
- [x] Tests
  - [x] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !4780

Deployment and Play endpoints

See merge request !5825