From df53080d37701e341d282721d5ae368fa97cea9a Mon Sep 17 00:00:00 2001
From: Heinrich Lee Yu <heinrich@gitlab.com>
Date: Fri, 15 Mar 2019 08:07:52 +0800
Subject: Only return `commands_changes` used in frontend

When executing quick actions, this limits the `commands_changes`
response to only those used by the frontend
---
 app/controllers/concerns/notes_actions.rb          |  2 +-
 ...-fix-project-serialization-in-quick-actions.yml |  5 ++++
 spec/controllers/projects/notes_controller_spec.rb | 31 ++++++++++++++++++++++
 3 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/security-2826-fix-project-serialization-in-quick-actions.yml

diff --git a/app/controllers/concerns/notes_actions.rb b/app/controllers/concerns/notes_actions.rb
index b4fee93713b..f96d1821095 100644
--- a/app/controllers/concerns/notes_actions.rb
+++ b/app/controllers/concerns/notes_actions.rb
@@ -48,7 +48,7 @@ module NotesActions
     respond_to do |format|
       format.json do
         json = {
-          commands_changes: @note.commands_changes
+          commands_changes: @note.commands_changes&.slice(:emoji_award, :time_estimate, :spend_time)
         }
 
         if @note.persisted? && return_discussion?
diff --git a/changelogs/unreleased/security-2826-fix-project-serialization-in-quick-actions.yml b/changelogs/unreleased/security-2826-fix-project-serialization-in-quick-actions.yml
new file mode 100644
index 00000000000..272f8a95957
--- /dev/null
+++ b/changelogs/unreleased/security-2826-fix-project-serialization-in-quick-actions.yml
@@ -0,0 +1,5 @@
+---
+title: Remove project serialization in quick actions response
+merge_request:
+author:
+type: security
diff --git a/spec/controllers/projects/notes_controller_spec.rb b/spec/controllers/projects/notes_controller_spec.rb
index 0b0f5117784..deecb7fefe9 100644
--- a/spec/controllers/projects/notes_controller_spec.rb
+++ b/spec/controllers/projects/notes_controller_spec.rb
@@ -413,6 +413,37 @@ describe Projects::NotesController do
         end
       end
     end
+
+    context 'when creating a note with quick actions' do
+      context 'with commands that return changes' do
+        let(:note_text) { "/award :thumbsup:\n/estimate 1d\n/spend 3h" }
+
+        it 'includes changes in commands_changes ' do
+          post :create, params: request_params.merge(note: { note: note_text }, format: :json)
+
+          expect(response).to have_gitlab_http_status(200)
+          expect(json_response['commands_changes']).to include('emoji_award', 'time_estimate', 'spend_time')
+          expect(json_response['commands_changes']).not_to include('target_project', 'title')
+        end
+      end
+
+      context 'with commands that do not return changes' do
+        let(:issue) { create(:issue, project: project) }
+        let(:other_project) { create(:project) }
+        let(:note_text) { "/move #{other_project.full_path}\n/title AAA" }
+
+        before do
+          other_project.add_developer(user)
+        end
+
+        it 'does not include changes in commands_changes' do
+          post :create, params: request_params.merge(note: { note: note_text }, target_type: 'issue', target_id: issue.id, format: :json)
+
+          expect(response).to have_gitlab_http_status(200)
+          expect(json_response['commands_changes']).not_to include('target_project', 'title')
+        end
+      end
+    end
   end
 
   describe 'PUT update' do
-- 
cgit v1.2.1


From 2c90d094d2704b58f2dec434e6cd08427ebaf20a Mon Sep 17 00:00:00 2001
From: GitLab Release Tools Bot <robert+release-tools@gitlab.com>
Date: Wed, 20 Mar 2019 10:54:39 +0000
Subject: Update VERSION to 11.9.0-rc9

---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 1b50b9eecca..acf5860546c 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-11.9.0-rc8
+11.9.0-rc9
-- 
cgit v1.2.1