Update CHANGELOG.md for 11.6.7

[ci skip]
parent 8c73f4cf
......@@ -2,6 +2,40 @@
documentation](doc/development/changelog.md) for instructions on adding your own
entry.
## 11.6.7 (2019-01-29)
### Security (24 changes, 1 of them is from the community)
- Make potentially malicious links more visible in the UI and scrub RTLO chars from links. !2770
- Don't process MR refs for guests in the notes. !2771
- Sanitize user full name to clean up any URL to prevent mail clients from auto-linking URLs. !2829
- Fixed XSS content in KaTex links.
- Disallows unauthorized users from accessing the pipelines section.
- Verify that LFS upload requests are genuine.
- Bump Ruby on Rails to 4.2.11. (@blackst0ne)
- Prevent awarding emojis to notes whose parent is not visible to user.
- Prevent unauthorized replies when discussion is locked or confidential.
- Disable git v2 protocol temporarily.
- Fix showing ci status for guest users when public pipline are not set.
- Fix contributed projects info still visible when user enable private profile.
- Extract GitLab Pages using RubyZip.
- Add more LFS validations to prevent forgery.
- Use common error for unauthenticated users when creating issues.
- Fix slow regex in project reference pattern.
- Fix private user email being visible in push (and tag push) webhooks.
- Fix wiki access rights when external wiki is enabled.
- Group guests are no longer able to see merge requests they don't have access to at group level.
- Fix path disclosure on project import error.
- Restrict project import visibility based on its group.
- Expose CI/CD trigger token only to the trigger owner.
- Notify only users who can access the project on project move.
- Alias GitHub and BitBucket OAuth2 callback URLs.
### Fixed (1 change)
- Fix uninitialized constant with GitLab Pages.
## 11.6.6 (2019-01-28)
- Unreleased due to quality assurance failure.
......
---
title: Fixed XSS content in KaTex links
merge_request:
author:
type: security
---
title: Bump Ruby on Rails to 4.2.11
merge_request:
author: "@blackst0ne"
type: security
---
title: Extract GitLab Pages using RubyZip
merge_request:
author:
type: security
---
title: Sanitize user full name to clean up any URL to prevent mail clients from auto-linking
URLs
merge_request: 2829
author:
type: security
---
title: Disallows unauthorized users from accessing the pipelines section.
merge_request:
author:
type: security
---
title: Verify that LFS upload requests are genuine
merge_request:
author:
type: security
---
title: Make potentially malicious links more visible in the UI and scrub RTLO chars from links
merge_request: 2770
author:
type: security
---
title: Prevent awarding emojis to notes whose parent is not visible to user
merge_request:
author:
type: security
---
title: Prevent unauthorized replies when discussion is locked or confidential
merge_request:
author:
type: security
---
title: Disable git v2 protocol temporarily
merge_request:
author:
type: security
---
title: Fix showing ci status for guest users when public pipline are not set
merge_request:
author:
type: security
---
title: Fix contributed projects info still visible when user enable private profile
merge_request:
author:
type: security
---
title: Don't process MR refs for guests in the notes
merge_request: 2771
author:
type: security
---
title: Add more LFS validations to prevent forgery
merge_request:
author:
type: security
---
title: Use common error for unauthenticated users when creating issues
merge_request:
author:
type: security
---
title: Fix slow regex in project reference pattern
merge_request:
author:
type: security
---
title: Fix private user email being visible in push (and tag push) webhooks
merge_request:
author:
type: security
---
title: Fix wiki access rights when external wiki is enabled
merge_request:
author:
type: security
---
title: Group guests are no longer able to see merge requests they don't have access
to at group level
merge_request:
author:
type: security
---
title: Fix path disclosure on project import error
merge_request:
author:
type: security
---
title: Restrict project import visibility based on its group
merge_request:
author:
type: security
---
title: Expose CI/CD trigger token only to the trigger owner
merge_request:
author:
type: security
---
title: Notify only users who can access the project on project move.
merge_request:
author:
type: security
---
title: Alias GitHub and BitBucket OAuth2 callback URLs
merge_request:
author:
type: security
---
title: Fix uninitialized constant with GitLab Pages
merge_request:
author:
type: fixed
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment