summaryrefslogtreecommitdiff
path: root/CHANGELOG.md
diff options
context:
space:
mode:
authorJose Ivan Vargas <jvargas@gitlab.com>2017-09-06 16:34:19 -0500
committerJose Ivan Vargas <jvargas@gitlab.com>2017-09-06 16:34:19 -0500
commit916e16426d6d0d726b1cb3f57fffe1136808ecd0 (patch)
tree4ca7a7246ac1c1f0fd26ab7a773f1c22c149d5cf /CHANGELOG.md
parentd1b60cbc67dc14b21820ef3f823a8e1ea851697d (diff)
downloadgitlab-ce-916e16426d6d0d726b1cb3f57fffe1136808ecd0.tar.gz
Update CHANGELOG.md for 9.3.11
[ci skip]
Diffstat (limited to 'CHANGELOG.md')
-rw-r--r--CHANGELOG.md18
1 files changed, 18 insertions, 0 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a02b6594fad..e7bc279eefd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -453,6 +453,24 @@ entry.
- Log rescued exceptions to Sentry.
- Remove remaining N+1 queries in merge requests API with emojis and labels.
+## 9.3.11 (2017-09-06)
+
+- [SECURITY] Upgrade mail and nokogiri gems due to security issues. !13662 (Markus Koller)
+- [SECURITY] Prevent a persistent XSS in the commit author block.
+- Improve support for external issue references. !12485
+- Use uploads/system directory for personal snippets.
+- Remove uploads/appearance symlink. A leftover from a previous migration.
+- Fix XSS issue in go-get handling.
+- Remove hidden symlinks from project import files.
+- Fix an infinite loop when handling user-supplied regular expressions.
+- Fixes race condition in project uploads.
+- Fixes race condition in project uploads.
+- Disallow Git URLs that include a username or hostname beginning with a non-alphanumeric character.
+- Disallow arbitrary properties in `th` and `td` `style` attributes.
+- Resolve CSRF token leakage via pathname manipulation on environments page.
+- Disallow the `name` attribute on all user-provided markup.
+- Renders 404 if given project is not readable by the user on Todos dashboard.
+
## 9.3.10 (2017-08-09)
- Remove hidden symlinks from project import files.