Update CHANGELOG.md for 11.3.11

[ci skip]

CHANGELOG.md

@@ -2,6 +2,45 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
+## 11.3.11 (2018-11-26)
+
+### Security (33 changes)
+
+- Filter user sensitive data from discussions JSON. !2537
+- Escape entity title while autocomplete template rendering to prevent XSS. !2557
+- Restrict Personal Access Tokens to API scope on web requests.
+- Fix XSS in merge request source branch name.
+- Escape user fullname while rendering autocomplete template to prevent XSS.
+- Fix CRLF vulnerability in Project hooks.
+- Fix possible XSS attack in Markdown urls with spaces.
+- Redact sensitive information on gitlab-workhorse log.
+- Set timeout for syntax highlighting.
+- Do not follow redirects in Prometheus service when making http requests to the configured api url.
+- Persist only SHA digest of PersonalAccessToken#token.
+- Sanitize JSON data properly to fix XSS on Issue details page.
+- Don't expose confidential information in commit message list.
+- Markdown API no longer displays confidential title references unless authorized.
+- Provide email notification when a user changes their email address.
+- Properly filter private references from system notes.
+- Redact personal tokens in unsubscribe links.
+- Resolve reflected XSS in Ouath authorize window.
+- Fix SSRF in project integrations.
+- Fix stored XSS in merge requests from imported repository.
+- Fixed ability to comment on locked/confidential issues.
+- Fixed ability of guest users to edit/delete comments on locked or confidential issues.
+- Fix milestone promotion authorization check.
+- Monkey kubeclient to not follow any redirects.
+- Configure mermaid to not render HTML content in diagrams.
+- Redact confidential events in the API.
+- Fix xss vulnerability sourced from package.json.
+- Fix a possible symlink time of check to time of use race condition in GitLab Pages.
+- Removed ability to see private group names when the group id is entered in the url.
+- Fix stored XSS for Environments.
+- Block loopback addresses in UrlBlocker.
+- Prevent SSRF attacks in HipChat integration.
+- Validate Wiki attachments are valid temporary files.
+
+
 ## 11.3.10 (2018-11-18)
 ### Security (1 change)

changelogs/unreleased/51527-xss-in-mr-source-branch.yml

----
-title: Fix XSS in merge request source branch name
-merge_request:
-author:
-type: security

changelogs/unreleased/fix-events-finder-incomplete.yml

----
-title: Redact confidential events in the API
-merge_request:
-author:
-type: security

changelogs/unreleased/redact-links-dev.yml

----
-title: Redact personal tokens in unsubscribe links.
-merge_request:
-author:
-type: security

changelogs/unreleased/security-11-3-2717-fix-issue-title-xss.yml

----
-title: Escape entity title while autocomplete template rendering to prevent XSS
-merge_request: 2557
-author:
-type: security

changelogs/unreleased/security-11-3-2717-xss-username-autocomplete.yml

----
-title: Escape user fullname while rendering autocomplete template to prevent XSS
-merge_request:
-author:
-type: security

changelogs/unreleased/security-11-3-fj-crlf-injection.yml

----
-title: Fix CRLF vulnerability in Project hooks
-merge_request:
-author:
-type: security

changelogs/unreleased/security-11-3-xss-in-markdown-following-unrecognized-html-element.yml

----
-title: Fix possible XSS attack in Markdown urls with spaces
-merge_request:
-author:
-type: security

changelogs/unreleased/security-182-update-workhorse.yml

----
-title: Redact sensitive information on gitlab-workhorse log
-merge_request:
-author:
-type: security

changelogs/unreleased/security-2697-code-highlight-timeout.yml

----
-title: Set timeout for syntax highlighting
-merge_request:
-author:
-type: security

changelogs/unreleased/security-2736-prometheus-ssrf.yml

----
-title: Do not follow redirects in Prometheus service when making http requests to the configured api url
-merge_request:
-author:
-type: security

changelogs/unreleased/security-51113-hash_personal_access_tokens.yml

----
-title: Persist only SHA digest of PersonalAccessToken#token
-merge_request:
-author:
-type: security

changelogs/unreleased/security-acet-issue-details.yml

----
-title: Sanitize JSON data properly to fix XSS on Issue details page
-merge_request:
-author:
-type: security

changelogs/unreleased/security-bvl-exposure-in-commits-list.yml

----
-title: Don't expose confidential information in commit message list
-merge_request:
-author:
-type: security

changelogs/unreleased/security-bw-confidential-titles-through-markdown-api.yml

----
-title: Markdown API no longer displays confidential title references unless authorized
-merge_request:
-author:
-type: security

changelogs/unreleased/security-email-change-notification.yml

----
-title: Provide email notification when a user changes their email address
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fix-leaking-private-project-namespace.yml

----
-title: Properly filter private references from system notes
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fix-pat-web-access.yml

----
-title: Restrict Personal Access Tokens to API scope on web requests
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fix-uri-xss-applications.yml

----
-title: Resolve reflected XSS in Ouath authorize window
-merge_request:
-author:
-type: security

changelogs/unreleased/security-fix-webhook-ssrf-ipv6.yml

----
-title: Fix SSRF in project integrations
-merge_request: 
-author:
-type: security