diff options
| author | Oswaldo Ferreira <oswaldo@gitlab.com> | 2018-01-10 20:27:31 -0200 |
|---|---|---|
| committer | Oswaldo Ferreira <oswaldo@gitlab.com> | 2018-01-10 20:27:31 -0200 |
| commit | f58e165b2afb7718ecbdbf50201a394217e269b3 (patch) | |
| tree | 2db01bb8c959fa2cfc618db722e5f33398beb6de | |
| parent | b60908b8d8c08f4a6029501f3fd6d6934929edaa (diff) | |
| download | gitlab-ce-f58e165b2afb7718ecbdbf50201a394217e269b3.tar.gz | |
Update CHANGELOG.md for 10.3.4
[ci skip]
| -rw-r--r-- | CHANGELOG.md | 13 | ||||
| -rw-r--r-- | changelogs/unreleased/api-no-service-pw-output.yml | 5 | ||||
| -rw-r--r-- | changelogs/unreleased/fix-import-rce.yml | 5 | ||||
| -rw-r--r-- | changelogs/unreleased/jej-fix-disabled-oauth-access.yml | 5 | ||||
| -rw-r--r-- | changelogs/unreleased/milestones-finder-order-fix.yml | 5 | ||||
| -rw-r--r-- | changelogs/unreleased/projectfix.yml | 6 | ||||
| -rw-r--r-- | changelogs/unreleased/security-10-3.yml | 5 | ||||
| -rw-r--r-- | changelogs/unreleased/sh-migrate-can-push-to-deploy-keys-projects.yml | 5 |
8 files changed, 13 insertions, 36 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index e8286870605..3aebb1c6c30 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,19 @@ documentation](doc/development/changelog.md) for instructions on adding your own entry. +## 10.3.4 (2018-01-10) + +### Security (7 changes, 1 of them is from the community) + +- Prevent a SQL injection in the MilestonesFinder. +- Fix RCE via project import mechanism. +- Prevent OAuth login POST requests when a provider has been disabled. +- Filter out sensitive fields from the project services API. (Robert Schilling) +- Check user authorization for source and target projects when creating a merge request. +- Fix path traversal in gitlab-ci.yml cache:key. +- Fix writable shared deploy keys. + + ## 10.3.3 (2018-01-02) ### Fixed (3 changes) diff --git a/changelogs/unreleased/api-no-service-pw-output.yml b/changelogs/unreleased/api-no-service-pw-output.yml deleted file mode 100644 index f0d0adaad1c..00000000000 --- a/changelogs/unreleased/api-no-service-pw-output.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Filter out sensitive fields from the project services API -merge_request: -author: Robert Schilling -type: security diff --git a/changelogs/unreleased/fix-import-rce.yml b/changelogs/unreleased/fix-import-rce.yml deleted file mode 100644 index c47e45fac31..00000000000 --- a/changelogs/unreleased/fix-import-rce.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Fix RCE via project import mechanism -merge_request: -author: -type: security diff --git a/changelogs/unreleased/jej-fix-disabled-oauth-access.yml b/changelogs/unreleased/jej-fix-disabled-oauth-access.yml deleted file mode 100644 index 3a92c432dc6..00000000000 --- a/changelogs/unreleased/jej-fix-disabled-oauth-access.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Prevent OAuth login POST requests when a provider has been disabled -merge_request: -author: -type: security diff --git a/changelogs/unreleased/milestones-finder-order-fix.yml b/changelogs/unreleased/milestones-finder-order-fix.yml deleted file mode 100644 index 983c301a82d..00000000000 --- a/changelogs/unreleased/milestones-finder-order-fix.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Prevent a SQL injection in the MilestonesFinder -merge_request: -author: -type: security diff --git a/changelogs/unreleased/projectfix.yml b/changelogs/unreleased/projectfix.yml deleted file mode 100644 index 4d8ebe6194a..00000000000 --- a/changelogs/unreleased/projectfix.yml +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: Check user authorization for source and target projects when creating a merge - request. -merge_request: -author: -type: security diff --git a/changelogs/unreleased/security-10-3.yml b/changelogs/unreleased/security-10-3.yml deleted file mode 100644 index 5c718d976cd..00000000000 --- a/changelogs/unreleased/security-10-3.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Fix path traversal in gitlab-ci.yml cache:key -merge_request: -author: -type: security diff --git a/changelogs/unreleased/sh-migrate-can-push-to-deploy-keys-projects.yml b/changelogs/unreleased/sh-migrate-can-push-to-deploy-keys-projects.yml deleted file mode 100644 index cb53a94e465..00000000000 --- a/changelogs/unreleased/sh-migrate-can-push-to-deploy-keys-projects.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Fix writable shared deploy keys -merge_request: -author: -type: security |