Update CHANGELOG.md for 11.5.8

[ci skip]

CHANGELOG.md

@@ -2,6 +2,33 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
+## 11.5.8 (2019-01-28)
+
+### Security (21 changes)
+
+- Make potentially malicious links more visible in the UI and scrub RTLO chars from links. !2770
+- Don't process MR refs for guests in the notes. !2771
+- Fixed XSS content in KaTex links.
+- Verify that LFS upload requests are genuine.
+- Extract GitLab Pages using RubyZip.
+- Prevent awarding emojis to notes whose parent is not visible to user.
+- Prevent unauthorized replies when discussion is locked or confidential.
+- Disable git v2 protocol temporarily.
+- Fix showing ci status for guest users when public pipline are not set.
+- Fix contributed projects info still visible when user enable private profile.
+- Disallows unauthorized users from accessing the pipelines section.
+- Add more LFS validations to prevent forgery.
+- Use common error for unauthenticated users when creating issues.
+- Fix slow regex in project reference pattern.
+- Fix private user email being visible in push (and tag push) webhooks.
+- Fix wiki access rights when external wiki is enabled.
+- Fix path disclosure on project import error.
+- Restrict project import visibility based on its group.
+- Expose CI/CD trigger token only to the trigger owner.
+- Notify only users who can access the project on project move.
+- Alias GitHub and BitBucket OAuth2 callback URLs.
+
+
 ## 11.5.7 (2019-01-15)
 ### Security (1 change)

changelogs/unreleased/11-5-security-stored-xss-via-katex.yml

----
-title: Fixed XSS content in KaTex links
-merge_request:
-author:
-type: security

changelogs/unreleased/extract-pages-with-rubyzip.yml

----
-title: Extract GitLab Pages using RubyZip
-merge_request:
-author:
-type: security

changelogs/unreleased/security-11-5-test-permissions.yml

----
-title: Disallows unauthorized users from accessing the pipelines section.
-merge_request:
-author:
-type: security

changelogs/unreleased/security-2767-verify-lfs-finalize-from-workhorse.yml

----
-title: Verify that LFS upload requests are genuine
-merge_request:
-author:
-type: security

changelogs/unreleased/security-2769-idn-homograph-attack.yml

----
-title: Make potentially malicious links more visible in the UI and scrub RTLO chars from links
-merge_request: 2770
-author:
-type: security

changelogs/unreleased/security-2776-fix-add-reaction-permissions.yml

----
-title: Prevent awarding emojis to notes whose parent is not visible to user
-merge_request:
-author:
-type: security

changelogs/unreleased/security-2779-fix-email-comment-permissions-check.yml

----
-title: Prevent unauthorized replies when discussion is locked or confidential
-merge_request:
-author:
-type: security

changelogs/unreleased/security-2780-disable-git-v2-protocol.yml

----
-title: Disable git v2 protocol temporarily
-merge_request:
-author:
-type: security

changelogs/unreleased/security-commit-status-shown-for-guest-user.yml

----
-title: Fix showing ci status for guest users when public pipline are not set
-merge_request:
-author:
-type: security

changelogs/unreleased/security-contributed-projects.yml

----
-title: Fix contributed projects info still visible when user enable private profile
-merge_request:
-author:
-type: security

changelogs/unreleased/security-do-not-process-mr-ref-for-guests.yml

----
-title: Don't process MR refs for guests in the notes
-merge_request: 2771
-author:
-type: security

changelogs/unreleased/security-fix-lfs-import-project-ssrf-forgery.yml

----
-title: Add more LFS validations to prevent forgery
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fix-new-issues-login-message.yml

----
-title: Use common error for unauthenticated users when creating issues
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fix-regex-dos.yml

----
-title: Fix slow regex in project reference pattern
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fix-user-email-tag-push-leak.yml

----
-title: Fix private user email being visible in push (and tag push) webhooks
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fix-wiki-access-rights-with-external-wiki-enabled.yml

----
-title: Fix wiki access rights when external wiki is enabled
-merge_request:
-author:
-type: security

changelogs/unreleased/security-import-path-logging.yml

----
-title: Fix path disclosure on project import error
-merge_request:
-author:
-type: security

changelogs/unreleased/security-import-project-visibility.yml

----
-title: Restrict project import visibility based on its group
-merge_request:
-author:
-type: security

changelogs/unreleased/security-pipeline-trigger-tokens-exposure.yml

----
-title: Expose CI/CD trigger token only to the trigger owner
-merge_request:
-author:
-type: security