Co-authored-by: Dany Marcoux <dmarcoux@suse.com>

Remove symlink to foreman in Dockerfile

This isn't needed anymore as it produces the following error:

ln: failed to create symbolic link '/usr/bin/foreman': File exists

Only allow admins to create sourceaccess/access repositories flags

Webui::RepositoriesController.create_flag allowed creating the
access/sourceaccess flags, while in
SourceController#project_command_set_flag this is only allowed for
admins.

This was fixed in master in:
https://github.com/openSUSE/open-build-service/pull/7169/commits/5f89387c86be9bcefffe64e78125efa88e3c3c4f

2.9 download repository policy

Add upper-limit to range to avoid long running queries (boo#1125812)

🚨 [security] [src/api - 2.9] Update rack: 2.0.5 → 2.0.6 (patch)

🚨 [security] [src/api - 2.9] Update loofah: 2.2.2 → 2.2.3 (patch)

Fix xml output for comments

This prevents the creation of a comment with the null character, that
would make the comment invalid for xml output.

Co-authored-by: Victor Pereira <vpereira@suse.com>

Prevent the xml renderer from throwing a 500 internal server error:

ActionView::Template::Error (string contains null byte)

Co-authored-by: Victor Pereira <vpereira@suse.com>

Broken with commit 30334760

Prevent creation of a request with an ID attribute

Co-authored-by: David Kang <dkang@suse.com>

This makes possible to add validations of the parsed xml in the
controller.

A bunch of us have talked about what the content of good commit meesages should
look like and came up with this template.

So you can switch branches without producing untracked files.

Commit afed7d40 fixed a
problem causing endless rebuilds but introduced a new bug
causing endless rebuilds in other corner cases. That's
why I hate messing with the gen_meta code, it's impossible
to test all corner cases.

It was different to the implementation in perl-BSSolv, leading
to endless rebuilds in some rare cases.

Deleting it by timestamp is too dangerous, as the assumption that
the API fetches the payload right after fetching the notification
event is no longer valid. So disable automatic pruning and rely
on the API doing manual delete requests.

It supports a project or url prefix as argument

[Security] Bump ffi from 1.9.18 to 1.9.25 in /src/api

Bumps [ffi](https://github.com/ffi/ffi) from 1.9.18 to 1.9.25. **This update includes security fixes.**
- [Release notes](https://github.com/ffi/ffi/releases)
- [Changelog](https://github.com/ffi/ffi/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ffi/ffi/compare/1.9.18...1.9.25

)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Disable notifications for Travis

Fix repository URL for running TravisCI

On 2.9 branch this was pointing to Unstable. This caused not to find
packages already deleted in Unstable, and TravisCI to fail.

Fix link 2 9

This is needed to address CVE-2018-3760.

  https://groups.google.com/forum/#!topic/rubyonrails-security/ft_J--l55fM