diff options
16 files changed, 18 insertions, 63 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index e55e878b129..3c36cc83888 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,24 @@ documentation](doc/development/changelog.md) for instructions on adding your own entry. +## 9.3.11 (2017-09-06) + +- [SECURITY] Upgrade mail and nokogiri gems due to security issues. !13662 (Markus Koller) +- [SECURITY] Prevent a persistent XSS in the commit author block. +- Improve support for external issue references. !12485 +- Use uploads/system directory for personal snippets. +- Remove uploads/appearance symlink. A leftover from a previous migration. +- Fix XSS issue in go-get handling. +- Remove hidden symlinks from project import files. +- Fix an infinite loop when handling user-supplied regular expressions. +- Fixes race condition in project uploads. +- Fixes race condition in project uploads. +- Disallow Git URLs that include a username or hostname beginning with a non-alphanumeric character. +- Disallow arbitrary properties in `th` and `td` `style` attributes. +- Resolve CSRF token leakage via pathname manipulation on environments page. +- Disallow the `name` attribute on all user-provided markup. +- Renders 404 if given project is not readable by the user on Todos dashboard. + ## 9.3.10 (2017-08-09) - Remove hidden symlinks from project import files. diff --git a/changelogs/unreleased/29943-environment-folder.yml b/changelogs/unreleased/29943-environment-folder.yml deleted file mode 100644 index 8434d07d86e..00000000000 --- a/changelogs/unreleased/29943-environment-folder.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Resolve CSRF token leakage via pathname manipulation on environments page -merge_request: -author: diff --git a/changelogs/unreleased/33303-404-for-unauthorized-project.yml b/changelogs/unreleased/33303-404-for-unauthorized-project.yml deleted file mode 100644 index 5a5a337129e..00000000000 --- a/changelogs/unreleased/33303-404-for-unauthorized-project.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Renders 404 if given project is not readable by the user on Todos dashboard -merge_request: -author: diff --git a/changelogs/unreleased/33359-pers-snippet-files-location.yml b/changelogs/unreleased/33359-pers-snippet-files-location.yml deleted file mode 100644 index 22fa301cb5e..00000000000 --- a/changelogs/unreleased/33359-pers-snippet-files-location.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Use uploads/system directory for personal snippets -merge_request: -author: diff --git a/changelogs/unreleased/adam-external-issue-references-spike.yml b/changelogs/unreleased/adam-external-issue-references-spike.yml deleted file mode 100644 index aeec6688425..00000000000 --- a/changelogs/unreleased/adam-external-issue-references-spike.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Improve support for external issue references -merge_request: 12485 -author: diff --git a/changelogs/unreleased/bvl-remove-appearance-symlink.yml b/changelogs/unreleased/bvl-remove-appearance-symlink.yml deleted file mode 100644 index 2b1c188528a..00000000000 --- a/changelogs/unreleased/bvl-remove-appearance-symlink.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Remove uploads/appearance symlink. A leftover from a previous migration. -merge_request: -author: diff --git a/changelogs/unreleased/dm-go-get-xss.yml b/changelogs/unreleased/dm-go-get-xss.yml deleted file mode 100644 index bf0a7f4bd3d..00000000000 --- a/changelogs/unreleased/dm-go-get-xss.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Fix XSS issue in go-get handling -merge_request: -author: diff --git a/changelogs/unreleased/fix-escape-commit-block.yml b/changelogs/unreleased/fix-escape-commit-block.yml deleted file mode 100644 index 0665c8e5db2..00000000000 --- a/changelogs/unreleased/fix-escape-commit-block.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Prevent a persistent XSS in the commit author block -merge_request: -author: -type: security diff --git a/changelogs/unreleased/fix-gem-security-updates.yml b/changelogs/unreleased/fix-gem-security-updates.yml deleted file mode 100644 index dce11d08402..00000000000 --- a/changelogs/unreleased/fix-gem-security-updates.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Upgrade mail and nokogiri gems due to security issues -merge_request: 13662 -author: Markus Koller -type: security diff --git a/changelogs/unreleased/fix-import-symbolink-links.yml b/changelogs/unreleased/fix-import-symbolink-links.yml deleted file mode 100644 index 36e73821bdc..00000000000 --- a/changelogs/unreleased/fix-import-symbolink-links.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Remove hidden symlinks from project import files -merge_request: -author: diff --git a/changelogs/unreleased/fix-re2-infinite-loop-nick.yml b/changelogs/unreleased/fix-re2-infinite-loop-nick.yml deleted file mode 100644 index 3c314ab2718..00000000000 --- a/changelogs/unreleased/fix-re2-infinite-loop-nick.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Fix an infinite loop when handling user-supplied regular expressions -merge_request: -author: diff --git a/changelogs/unreleased/race-condition-in-project-uploads-fix-9-3.yml b/changelogs/unreleased/race-condition-in-project-uploads-fix-9-3.yml deleted file mode 100644 index adf9d77bce8..00000000000 --- a/changelogs/unreleased/race-condition-in-project-uploads-fix-9-3.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Fixes race condition in project uploads -merge_request: -author: diff --git a/changelogs/unreleased/race-condition-in-project-uploads-fix-9-4.yml b/changelogs/unreleased/race-condition-in-project-uploads-fix-9-4.yml deleted file mode 100644 index adf9d77bce8..00000000000 --- a/changelogs/unreleased/race-condition-in-project-uploads-fix-9-4.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Fixes race condition in project uploads -merge_request: -author: diff --git a/changelogs/unreleased/rs-alphanumeric-ssh-params.yml b/changelogs/unreleased/rs-alphanumeric-ssh-params.yml deleted file mode 100644 index 426b01cafad..00000000000 --- a/changelogs/unreleased/rs-alphanumeric-ssh-params.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Disallow Git URLs that include a username or hostname beginning with a non-alphanumeric - character -merge_request: -author: diff --git a/changelogs/unreleased/rs-issue-36098.yml b/changelogs/unreleased/rs-issue-36098.yml deleted file mode 100644 index 56b92705a80..00000000000 --- a/changelogs/unreleased/rs-issue-36098.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Disallow arbitrary properties in `th` and `td` `style` attributes -merge_request: -author: diff --git a/changelogs/unreleased/rs-issue-36104.yml b/changelogs/unreleased/rs-issue-36104.yml deleted file mode 100644 index b050cd83175..00000000000 --- a/changelogs/unreleased/rs-issue-36104.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Disallow the `name` attribute on all user-provided markup -merge_request: -author: |