Merge branch 'security-id-email-xss' into 'master'

Escape path in new merge request mail See merge request gitlab/gitlabhq!3066
2019-04-25 10:39:05 +00:00 · 2019-04-25 10:39:05 +00:00 · 4c90443bf8
parent a1d52a3c50 716e71afde
commit 4c90443bf8
2 changed files with 6 additions and 1 deletions
--- a/app/views/notify/new_merge_request_email.html.haml
+++ b/app/views/notify/new_merge_request_email.html.haml
@ -3,7 +3,7 @@
    #{link_to @merge_request.author_name, user_url(@merge_request.author)} created a merge request:

 %p.details
-  != merge_path_description(@merge_request, '&rarr;')
+  = merge_path_description(@merge_request, '→')

 - if @merge_request.assignees.any?
  %p
--- a/changelogs/unreleased/security-id-email-xss.yml
+++ b/changelogs/unreleased/security-id-email-xss.yml
@ -0,0 +1,5 @@
+---
+title: Escape path in new merge request mail
+merge_request:
+author:
+type: security