Backport security fix from GitLab 12.10.2
This may mean also backporting heptapod-docker#4 (closed) to ship in the Docker image for %Heptapod 0.12.3.
According to the security release notes:
Workhorse Bypass Leads to File Disclosure
A specially crafted request could bypass the GitLab Workhorse and read files in certain specific paths on the server. This issue is now mitigated in the latest release and the CVE identifier is pending.