Skip to content
Snippets Groups Projects
Unverified Commit 81e815ed authored by Robert Speicher's avatar Robert Speicher
Browse files

Revert "Update CHANGELOG.md for 11.7.1"

This reverts commit 1d469732.
parent 7850abaa
No related branches found
No related tags found
No related merge requests found
Showing
with 97 additions and 30 deletions
Loading
Loading
@@ -2,36 +2,6 @@
documentation](doc/development/changelog.md) for instructions on adding your own
entry.
 
## 11.7.1 (2019-01-28)
### Security (24 changes)
- Make potentially malicious links more visible in the UI and scrub RTLO chars from links. !2770
- Don't process MR refs for guests in the notes. !2771
- Sanitize user full name to clean up any URL to prevent mail clients from auto-linking URLs. !2828
- Fixed XSS content in KaTex links.
- Disallows unauthorized users from accessing the pipelines section.
- Verify that LFS upload requests are genuine.
- Extract GitLab Pages using RubyZip.
- Prevent awarding emojis to notes whose parent is not visible to user.
- Prevent unauthorized replies when discussion is locked or confidential.
- Disable git v2 protocol temporarily.
- Fix showing ci status for guest users when public pipline are not set.
- Fix contributed projects info still visible when user enable private profile.
- Add subresources removal to member destroy service.
- Add more LFS validations to prevent forgery.
- Use common error for unauthenticated users when creating issues.
- Fix slow regex in project reference pattern.
- Fix private user email being visible in push (and tag push) webhooks.
- Fix wiki access rights when external wiki is enabled.
- Group guests are no longer able to see merge requests they don't have access to at group level.
- Fix path disclosure on project import error.
- Restrict project import visibility based on its group.
- Expose CI/CD trigger token only to the trigger owner.
- Notify only users who can access the project on project move.
- Alias GitHub and BitBucket OAuth2 callback URLs.
## 11.7.0 (2019-01-22)
 
### Security (14 changes, 1 of them is from the community)
Loading
Loading
---
title: Fixed XSS content in KaTex links
merge_request:
author:
type: security
---
title: Extract GitLab Pages using RubyZip
merge_request:
author:
type: security
---
title: Add subresources removal to member destroy service
merge_request:
author:
type: security
---
title: Sanitize user full name to clean up any URL to prevent mail clients from auto-linking
URLs
merge_request: 2828
author:
type: security
---
title: Disallows unauthorized users from accessing the pipelines section.
merge_request:
author:
type: security
---
title: Verify that LFS upload requests are genuine
merge_request:
author:
type: security
---
title: Make potentially malicious links more visible in the UI and scrub RTLO chars from links
merge_request: 2770
author:
type: security
---
title: Prevent awarding emojis to notes whose parent is not visible to user
merge_request:
author:
type: security
---
title: Prevent unauthorized replies when discussion is locked or confidential
merge_request:
author:
type: security
---
title: Disable git v2 protocol temporarily
merge_request:
author:
type: security
---
title: Fix showing ci status for guest users when public pipline are not set
merge_request:
author:
type: security
---
title: Fix contributed projects info still visible when user enable private profile
merge_request:
author:
type: security
---
title: Don't process MR refs for guests in the notes
merge_request: 2771
author:
type: security
---
title: Add more LFS validations to prevent forgery
merge_request:
author:
type: security
---
title: Use common error for unauthenticated users when creating issues
merge_request:
author:
type: security
---
title: Fix slow regex in project reference pattern
merge_request:
author:
type: security
---
title: Fix private user email being visible in push (and tag push) webhooks
merge_request:
author:
type: security
---
title: Fix wiki access rights when external wiki is enabled
merge_request:
author:
type: security
---
title: Group guests are no longer able to see merge requests they don't have access
to at group level
merge_request:
author:
type: security
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment