Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Support
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
G
gitlab-ce
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
0
Issues
0
List
Boards
Labels
Milestones
Merge Requests
0
Merge Requests
0
Analytics
Analytics
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Commits
Issue Boards
Open sidebar
Léo-Paul Géneau
gitlab-ce
Commits
c0dbf23c
Commit
c0dbf23c
authored
5 years ago
by
GitLab Release Tools Bot
Committed by
Yorick Peterse
5 years ago
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Update CHANGELOG.md for 11.5.8
[ci skip]
parent
3b6a88cc
No related merge requests found
Changes
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
27 additions
and
0 deletions
+27
-0
CHANGELOG.md
CHANGELOG.md
+27
-0
No files found.
CHANGELOG.md
View file @
c0dbf23c
...
...
@@ -558,6 +558,33 @@ entry.
-
Enable Rubocop on lib/gitlab. (gfyoung)
## 11.5.8 (2019-01-28)
### Security (21 changes)
-
Make potentially malicious links more visible in the UI and scrub RTLO chars from links. !2770
-
Don't process MR refs for guests in the notes. !2771
-
Fixed XSS content in KaTex links.
-
Verify that LFS upload requests are genuine.
-
Extract GitLab Pages using RubyZip.
-
Prevent awarding emojis to notes whose parent is not visible to user.
-
Prevent unauthorized replies when discussion is locked or confidential.
-
Disable git v2 protocol temporarily.
-
Fix showing ci status for guest users when public pipline are not set.
-
Fix contributed projects info still visible when user enable private profile.
-
Disallows unauthorized users from accessing the pipelines section.
-
Add more LFS validations to prevent forgery.
-
Use common error for unauthenticated users when creating issues.
-
Fix slow regex in project reference pattern.
-
Fix private user email being visible in push (and tag push) webhooks.
-
Fix wiki access rights when external wiki is enabled.
-
Fix path disclosure on project import error.
-
Restrict project import visibility based on its group.
-
Expose CI/CD trigger token only to the trigger owner.
-
Notify only users who can access the project on project move.
-
Alias GitHub and BitBucket OAuth2 callback URLs.
## 11.5.5 (2018-12-20)
### Security (1 change)
...
...
This diff is collapsed.
Click to expand it.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment