Update CHANGELOG.md for 11.7.1

[ci skip]

CHANGELOG.md

@@ -2,6 +2,36 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
+## 11.7.1 (2019-01-28)
+
+### Security (24 changes)
+
+- Make potentially malicious links more visible in the UI and scrub RTLO chars from links. !2770
+- Don't process MR refs for guests in the notes. !2771
+- Sanitize user full name to clean up any URL to prevent mail clients from auto-linking URLs. !2828
+- Fixed XSS content in KaTex links.
+- Disallows unauthorized users from accessing the pipelines section.
+- Verify that LFS upload requests are genuine.
+- Extract GitLab Pages using RubyZip.
+- Prevent awarding emojis to notes whose parent is not visible to user.
+- Prevent unauthorized replies when discussion is locked or confidential.
+- Disable git v2 protocol temporarily.
+- Fix showing ci status for guest users when public pipline are not set.
+- Fix contributed projects info still visible when user enable private profile.
+- Add subresources removal to member destroy service.
+- Add more LFS validations to prevent forgery.
+- Use common error for unauthenticated users when creating issues.
+- Fix slow regex in project reference pattern.
+- Fix private user email being visible in push (and tag push) webhooks.
+- Fix wiki access rights when external wiki is enabled.
+- Group guests are no longer able to see merge requests they don't have access to at group level.
+- Fix path disclosure on project import error.
+- Restrict project import visibility based on its group.
+- Expose CI/CD trigger token only to the trigger owner.
+- Notify only users who can access the project on project move.
+- Alias GitHub and BitBucket OAuth2 callback URLs.
+
+
 ## 11.7.0 (2019-01-22)
 ### Security (14 changes, 1 of them is from the community)

changelogs/unreleased/11-7-security-stored-xss-via-katex.yml

----
-title: Fixed XSS content in KaTex links
-merge_request:
-author:
-type: security

changelogs/unreleased/extract-pages-with-rubyzip.yml

----
-title: Extract GitLab Pages using RubyZip
-merge_request:
-author:
-type: security

changelogs/unreleased/fix-security-group-user-removal.yml

----
-title: Add subresources removal to member destroy service
-merge_request:
-author:
-type: security

changelogs/unreleased/security-11-7-22076-sanitize-url-in-names.yml

----
-title: Sanitize user full name to clean up any URL to prevent mail clients from auto-linking
-  URLs
-merge_request: 2828
-author:
-type: security

changelogs/unreleased/security-11-7-test-permissions.yml

----
-title: Disallows unauthorized users from accessing the pipelines section.
-merge_request:
-author:
-type: security

changelogs/unreleased/security-2767-verify-lfs-finalize-from-workhorse.yml

----
-title: Verify that LFS upload requests are genuine
-merge_request:
-author:
-type: security

changelogs/unreleased/security-2769-idn-homograph-attack.yml

----
-title: Make potentially malicious links more visible in the UI and scrub RTLO chars from links
-merge_request: 2770
-author:
-type: security

changelogs/unreleased/security-2776-fix-add-reaction-permissions.yml

----
-title: Prevent awarding emojis to notes whose parent is not visible to user
-merge_request:
-author:
-type: security

changelogs/unreleased/security-2779-fix-email-comment-permissions-check.yml

----
-title: Prevent unauthorized replies when discussion is locked or confidential
-merge_request:
-author:
-type: security

changelogs/unreleased/security-2780-disable-git-v2-protocol.yml

----
-title: Disable git v2 protocol temporarily
-merge_request:
-author:
-type: security

changelogs/unreleased/security-commit-status-shown-for-guest-user.yml

----
-title: Fix showing ci status for guest users when public pipline are not set
-merge_request:
-author:
-type: security

changelogs/unreleased/security-contributed-projects.yml

----
-title: Fix contributed projects info still visible when user enable private profile
-merge_request:
-author:
-type: security

changelogs/unreleased/security-do-not-process-mr-ref-for-guests.yml

----
-title: Don't process MR refs for guests in the notes
-merge_request: 2771
-author:
-type: security

changelogs/unreleased/security-fix-lfs-import-project-ssrf-forgery.yml

----
-title: Add more LFS validations to prevent forgery
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fix-new-issues-login-message.yml

----
-title: Use common error for unauthenticated users when creating issues
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fix-regex-dos.yml

----
-title: Fix slow regex in project reference pattern
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fix-user-email-tag-push-leak.yml

----
-title: Fix private user email being visible in push (and tag push) webhooks
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fix-wiki-access-rights-with-external-wiki-enabled.yml

----
-title: Fix wiki access rights when external wiki is enabled
-merge_request:
-author:
-type: security

changelogs/unreleased/security-guests-can-see-list-of-merge-requests.yml

----
-title: Group guests are no longer able to see merge requests they don't have access
-  to at group level
-merge_request:
-author:
-type: security