diff options
| author | John Jarvis <jarv@gitlab.com> | 2019-01-02 12:00:52 +0100 |
|---|---|---|
| committer | John Jarvis <jarv@gitlab.com> | 2019-01-02 12:00:52 +0100 |
| commit | 191f461b88ba80069c2b23229cc0e26253d4fcc7 (patch) | |
| tree | af345766ffb8ac93a2908da3cac6a4126d079b4b /changelogs | |
| parent | 5494f09a2909ebc2a67983efc375c0ce4ca15aab (diff) | |
| parent | 90e1f10f074607e1ae061e7bc3594a9dfe7873f8 (diff) | |
| download | gitlab-ce-191f461b88ba80069c2b23229cc0e26253d4fcc7.tar.gz | |
Merge branch 'master' of dev.gitlab.org:gitlab/gitlabhq
Diffstat (limited to 'changelogs')
4 files changed, 20 insertions, 0 deletions
diff --git a/changelogs/unreleased/54427-label-xss.yml b/changelogs/unreleased/54427-label-xss.yml new file mode 100644 index 00000000000..090d1832af2 --- /dev/null +++ b/changelogs/unreleased/54427-label-xss.yml @@ -0,0 +1,5 @@ +--- +title: Escape html entities in LabelReferenceFilter when no label found +merge_request: +author: +type: security diff --git a/changelogs/unreleased/security-master-secret-ci-variables-exposed.yml b/changelogs/unreleased/security-master-secret-ci-variables-exposed.yml new file mode 100644 index 00000000000..702181065f5 --- /dev/null +++ b/changelogs/unreleased/security-master-secret-ci-variables-exposed.yml @@ -0,0 +1,5 @@ +--- +title: Prevent leaking protected variables for ambiguous refs. +merge_request: +author: +type: security diff --git a/changelogs/unreleased/security-master-url-rel.yml b/changelogs/unreleased/security-master-url-rel.yml new file mode 100644 index 00000000000..75f599f6bcd --- /dev/null +++ b/changelogs/unreleased/security-master-url-rel.yml @@ -0,0 +1,5 @@ +--- +title: Set URL rel attribute for broken URLs. +merge_request: +author: +type: security diff --git a/changelogs/unreleased/security-todos_not_redacted_for_guests.yml b/changelogs/unreleased/security-todos_not_redacted_for_guests.yml new file mode 100644 index 00000000000..be0ae9a7193 --- /dev/null +++ b/changelogs/unreleased/security-todos_not_redacted_for_guests.yml @@ -0,0 +1,5 @@ +--- +title: Delete confidential todos for user when downgraded to Guest +merge_request: +author: +type: security |