diff options
author | Jose Ivan Vargas <jvargas@gitlab.com> | 2017-09-06 16:47:20 -0500 |
---|---|---|
committer | Jose Ivan Vargas <jvargas@gitlab.com> | 2017-09-06 16:47:20 -0500 |
commit | 26090dbb9bb5b5739a77011506d87dc2ee7f2848 (patch) | |
tree | 40b71bbcf91f8ec3cc1decd42a9dda2e49829678 | |
parent | 2aca01fd8a84e5a9ec49b4ebc0151dc89b7a2018 (diff) | |
download | gitlab-ce-26090dbb9bb5b5739a77011506d87dc2ee7f2848.tar.gz |
Update CHANGELOG.md for 9.4.6
[ci skip]
-rw-r--r-- | CHANGELOG.md | 12 | ||||
-rw-r--r-- | changelogs/unreleased/29943-environment-folder.yml | 4 | ||||
-rw-r--r-- | changelogs/unreleased/dm-go-get-xss.yml | 4 | ||||
-rw-r--r-- | changelogs/unreleased/fix-escape-commit-block.yml | 5 | ||||
-rw-r--r-- | changelogs/unreleased/fix-gem-security-updates.yml | 5 | ||||
-rw-r--r-- | changelogs/unreleased/fix-import-symbolink-links.yml | 4 | ||||
-rw-r--r-- | changelogs/unreleased/race-condition-in-project-uploads-fix-9-4.yml | 4 | ||||
-rw-r--r-- | changelogs/unreleased/rs-alphanumeric-ssh-params.yml | 5 | ||||
-rw-r--r-- | changelogs/unreleased/rs-issue-36098.yml | 4 | ||||
-rw-r--r-- | changelogs/unreleased/rs-issue-36104.yml | 4 |
10 files changed, 12 insertions, 39 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 186e2a31b58..81bcecc3da0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,18 @@ documentation](doc/development/changelog.md) for instructions on adding your own entry. +## 9.4.6 (2017-09-06) + +- [SECURITY] Upgrade mail and nokogiri gems due to security issues. !13662 (Markus Koller) +- [SECURITY] Prevent a persistent XSS in the commit author block. +- Fix XSS issue in go-get handling. +- Remove hidden symlinks from project import files. +- Fixes race condition in project uploads. +- Disallow Git URLs that include a username or hostname beginning with a non-alphanumeric character. +- Disallow arbitrary properties in `th` and `td` `style` attributes. +- Resolve CSRF token leakage via pathname manipulation on environments page. +- Disallow the `name` attribute on all user-provided markup. + ## 9.4.5 (2017-08-14) - Fix deletion of deploy keys linked to other projects. !13162 diff --git a/changelogs/unreleased/29943-environment-folder.yml b/changelogs/unreleased/29943-environment-folder.yml deleted file mode 100644 index 8434d07d86e..00000000000 --- a/changelogs/unreleased/29943-environment-folder.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Resolve CSRF token leakage via pathname manipulation on environments page -merge_request: -author: diff --git a/changelogs/unreleased/dm-go-get-xss.yml b/changelogs/unreleased/dm-go-get-xss.yml deleted file mode 100644 index bf0a7f4bd3d..00000000000 --- a/changelogs/unreleased/dm-go-get-xss.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Fix XSS issue in go-get handling -merge_request: -author: diff --git a/changelogs/unreleased/fix-escape-commit-block.yml b/changelogs/unreleased/fix-escape-commit-block.yml deleted file mode 100644 index 0665c8e5db2..00000000000 --- a/changelogs/unreleased/fix-escape-commit-block.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Prevent a persistent XSS in the commit author block -merge_request: -author: -type: security diff --git a/changelogs/unreleased/fix-gem-security-updates.yml b/changelogs/unreleased/fix-gem-security-updates.yml deleted file mode 100644 index dce11d08402..00000000000 --- a/changelogs/unreleased/fix-gem-security-updates.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Upgrade mail and nokogiri gems due to security issues -merge_request: 13662 -author: Markus Koller -type: security diff --git a/changelogs/unreleased/fix-import-symbolink-links.yml b/changelogs/unreleased/fix-import-symbolink-links.yml deleted file mode 100644 index 36e73821bdc..00000000000 --- a/changelogs/unreleased/fix-import-symbolink-links.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Remove hidden symlinks from project import files -merge_request: -author: diff --git a/changelogs/unreleased/race-condition-in-project-uploads-fix-9-4.yml b/changelogs/unreleased/race-condition-in-project-uploads-fix-9-4.yml deleted file mode 100644 index adf9d77bce8..00000000000 --- a/changelogs/unreleased/race-condition-in-project-uploads-fix-9-4.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Fixes race condition in project uploads -merge_request: -author: diff --git a/changelogs/unreleased/rs-alphanumeric-ssh-params.yml b/changelogs/unreleased/rs-alphanumeric-ssh-params.yml deleted file mode 100644 index 426b01cafad..00000000000 --- a/changelogs/unreleased/rs-alphanumeric-ssh-params.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Disallow Git URLs that include a username or hostname beginning with a non-alphanumeric - character -merge_request: -author: diff --git a/changelogs/unreleased/rs-issue-36098.yml b/changelogs/unreleased/rs-issue-36098.yml deleted file mode 100644 index 56b92705a80..00000000000 --- a/changelogs/unreleased/rs-issue-36098.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Disallow arbitrary properties in `th` and `td` `style` attributes -merge_request: -author: diff --git a/changelogs/unreleased/rs-issue-36104.yml b/changelogs/unreleased/rs-issue-36104.yml deleted file mode 100644 index b050cd83175..00000000000 --- a/changelogs/unreleased/rs-issue-36104.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -title: Disallow the `name` attribute on all user-provided markup -merge_request: -author: |