kotovalexarian-likes-gitlab
/
gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Merge remote-tracking branch 'dev/master'

This commit is contained in:
John T Skarbek 2020-04-30 15:57:50 -04:00
parent 028bb5dda7 b44c165115
commit adafb996ef
No known key found for this signature in database
GPG Key ID: D2BC1B2BC56ABF35
1 changed files with 42 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
CHANGELOG.md
View File

@ -2,6 +2,20 @@
documentation](doc/development/changelog.md) for instructions on adding your own
entry.
## 12.10.2 (2020-04-30)
### Security (8 changes)
- Ensure MR diff exists before codeowner check.
- Apply CODEOWNERS validations to web requests.
- Prevent unauthorized access to default branch.
- Do not return private project ID without permission.
- Fix doorkeeper CVE-2020-10187.
- Change GitHub service integration token input to password.
- Return only safe urls for mirrors.
- Validate workhorse 'rewritten_fields' and properly use them during multipart uploads.
## 12.10.1 (2020-04-24)
### Fixed (5 changes)
@ -463,6 +477,21 @@ entry.
- Remove store_mentions! in Snippets::CreateService. !29581 (Sashi Kumar)
## 12.9.5 (2020-04-30)
### Security (9 changes)
- Ensure MR diff exists before codeowner check.
- Apply CODEOWNERS validations to web requests.
- Prevent unauthorized access to default branch.
- Do not return private project ID without permission.
- Fix doorkeeper CVE-2020-10187.
- Prevent ES credentials leak.
- Change GitHub service integration token input to password.
- Return only safe urls for mirrors.
- Validate workhorse 'rewritten_fields' and properly use them during multipart uploads.
## 12.9.4 (2020-04-16)
- No changes.
@ -981,6 +1010,19 @@ entry.
- Improvement in token reference.
## 12.8.10 (2020-04-30)
### Security (7 changes)
- Ensure MR diff exists before codeowner check.
- Prevent unauthorized access to default branch.
- Do not return private project ID without permission.
- Fix doorkeeper CVE-2020-10187.
- Prevent ES credentials leak.
- Return only safe urls for mirrors.
- Validate workhorse 'rewritten_fields' and properly use them during multipart uploads.
## 12.8.9 (2020-04-14)
### Security (3 changes)