Add release notes for 2.9.7

🚨 [security] [src/api - 2.9] Update loofah: 2.2.3 → 2.3.1 (minor)

Fix openqa test for 2.9

The repository openSUSE Leap 42.3 was removed.

🚨 [security] [src/api - 2.9] Update nokogiri: 1.8.5 → 1.10.4 (minor)

Without this patch the test build will fail with following error:

[   84s] error: File /home/abuild/rpmbuild/SOURCES/obs-testpackage-0.0.1.tar.gz: No such file or directory

Update Leap 42.2 repository to Leap 15.1.

Use Leap 15.0 instead of Tumbleweed. Building in Tumbleweed is more
prone to build errors.

Co-authored-by: David Kang <dkang@suse.com>

Add ReleaseNotes for 2.9.6

Remove use_source from require_package

Co-authored-by: Dany Marcoux <dmarcoux@suse.com>

Co-authored-by: Dany Marcoux <dmarcoux@suse.com>

Authorize move_path

Co-authored-by: David Kang <dkang@suse.com>

Additionally turn the after_action around and maintain a whitelist instead of a blacklist. This requires new methods authorized by default.

new_package and its dialog are just informal authorizations, so people do not even try to do this.

Co-authored-by: Henne Vogelsang <hvogel@opensuse.org>
Co-authored-by: Saray Cabrera Padrón <scabrerapadron@suse.de>
Co-authored-by: David Kang <dkang@suse.com>

Remove symlink to foreman in Dockerfile

This isn't needed anymore as it produces the following error:

ln: failed to create symbolic link '/usr/bin/foreman': File exists

Only allow admins to create sourceaccess/access repositories flags

Webui::RepositoriesController.create_flag allowed creating the
access/sourceaccess flags, while in
SourceController#project_command_set_flag this is only allowed for
admins.

This was fixed in master in:
https://github.com/openSUSE/open-build-service/pull/7169/commits/5f89387c86be9bcefffe64e78125efa88e3c3c4f

2.9 download repository policy

Add upper-limit to range to avoid long running queries (boo#1125812)

🚨 [security] [src/api - 2.9] Update rack: 2.0.5 → 2.0.6 (patch)

🚨 [security] [src/api - 2.9] Update loofah: 2.2.2 → 2.2.3 (patch)

Fix xml output for comments

This prevents the creation of a comment with the null character, that
would make the comment invalid for xml output.

Co-authored-by: Victor Pereira <vpereira@suse.com>

Prevent the xml renderer from throwing a 500 internal server error:

ActionView::Template::Error (string contains null byte)

Co-authored-by: Victor Pereira <vpereira@suse.com>

Broken with commit 30334760

Prevent creation of a request with an ID attribute

Co-authored-by: David Kang <dkang@suse.com>

This makes possible to add validations of the parsed xml in the
controller.