Merge branch 'security-id-email-xss-11-8' into '11-8-stable'

Escape path in new merge request mail See merge request gitlab/gitlabhq!3070

Merge branch 'security-id-email-xss-11-8' into '11-8-stable'
bd952ce3 · GitLab Release Tools Bot · 2a94aaf8 · ff305e13 · bd952ce3 · bd952ce3
Commit bd952ce3 authored 5 years ago by GitLab Release Tools Bot
--- a/app/views/notify/new_merge_request_email.html.haml
+++ b/app/views/notify/new_merge_request_email.html.haml
@@ -3,7 +3,7 @@
    #{link_to @merge_request.author_name, user_url(@merge_request.author)} created a merge request:
  
 %p.details
-  != merge_path_description(@merge_request, '&rarr;')
+  = merge_path_description(@merge_request, '→')
  
 - if @merge_request.assignee_id.present?
  %p

--- a/changelogs/unreleased/security-id-email-xss.yml
+++ b/changelogs/unreleased/security-id-email-xss.yml
+---
+title: Escape path in new merge request mail
+merge_request:
+author:
+type: security