Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
G
gitlab-ce
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Boxiang Sun
gitlab-ce
Commits
b39d0c31
Commit
b39d0c31
authored
Sep 07, 2017
by
Robert Speicher
Browse files
Options
Browse Files
Download
Plain Diff
Merge remote-tracking branch 'dev/master'
parents
293cbdc9
b373c56c
Changes
2
Hide whitespace changes
Inline
Side-by-side
Showing
2 changed files
with
40 additions
and
5 deletions
+40
-5
CHANGELOG.md
CHANGELOG.md
+40
-0
changelogs/unreleased/fix-gem-security-updates.yml
changelogs/unreleased/fix-gem-security-updates.yml
+0
-5
No files found.
CHANGELOG.md
View file @
b39d0c31
...
...
@@ -2,6 +2,16 @@
documentation
](
doc/development/changelog.md
)
for instructions on adding your own
entry.
## 9.5.4 (2017-09-06)
-
[SECURITY] Upgrade mail and nokogiri gems due to security issues. !13662 (Markus Koller)
-
[SECURITY] Prevent a persistent XSS in the commit author block.
-
Fix XSS issue in go-get handling.
-
Resolve CSRF token leakage via pathname manipulation on environments page.
-
Fixes race condition in project uploads.
-
Disallow arbitrary properties in
`th`
and
`td`
`style`
attributes.
-
Disallow the
`name`
attribute on all user-provided markup.
## 9.5.3 (2017-09-03)
-
[SECURITY] Filter additional secrets from Rails logs.
...
...
@@ -203,6 +213,18 @@ entry.
-
Use a specialized class for querying events to improve performance.
-
Update build badges to be pipeline badges and display passing instead of success.
## 9.4.6 (2017-09-06)
-
[SECURITY] Upgrade mail and nokogiri gems due to security issues. !13662 (Markus Koller)
-
[SECURITY] Prevent a persistent XSS in the commit author block.
-
Fix XSS issue in go-get handling.
-
Remove hidden symlinks from project import files.
-
Fixes race condition in project uploads.
-
Disallow Git URLs that include a username or hostname beginning with a non-alphanumeric character.
-
Disallow arbitrary properties in
`th`
and
`td`
`style`
attributes.
-
Resolve CSRF token leakage via pathname manipulation on environments page.
-
Disallow the
`name`
attribute on all user-provided markup.
## 9.4.5 (2017-08-14)
-
Fix deletion of deploy keys linked to other projects. !13162
...
...
@@ -453,6 +475,24 @@ entry.
-
Log rescued exceptions to Sentry.
-
Remove remaining N+1 queries in merge requests API with emojis and labels.
## 9.3.11 (2017-09-06)
-
[SECURITY] Upgrade mail and nokogiri gems due to security issues. !13662 (Markus Koller)
-
[SECURITY] Prevent a persistent XSS in the commit author block.
-
Improve support for external issue references. !12485
-
Use uploads/system directory for personal snippets.
-
Remove uploads/appearance symlink. A leftover from a previous migration.
-
Fix XSS issue in go-get handling.
-
Remove hidden symlinks from project import files.
-
Fix an infinite loop when handling user-supplied regular expressions.
-
Fixes race condition in project uploads.
-
Fixes race condition in project uploads.
-
Disallow Git URLs that include a username or hostname beginning with a non-alphanumeric character.
-
Disallow arbitrary properties in
`th`
and
`td`
`style`
attributes.
-
Resolve CSRF token leakage via pathname manipulation on environments page.
-
Disallow the
`name`
attribute on all user-provided markup.
-
Renders 404 if given project is not readable by the user on Todos dashboard.
## 9.3.10 (2017-08-09)
-
Remove hidden symlinks from project import files.
...
...
changelogs/unreleased/fix-gem-security-updates.yml
deleted
100644 → 0
View file @
293cbdc9
---
title
:
Upgrade mail and nokogiri gems due to security issues
merge_request
:
13662
author
:
Markus Koller
type
:
security
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment