diff --git a/CHANGELOG.md b/CHANGELOG.md index 0b320e66535..c11311d3d07 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,21 @@ entry. ## 13.2.3 (2020-08-05) -- No changes. +### Security (12 changes) + +- Update kramdown gem to version 2.3.0. +- Enforce 2FA on Doorkeeper controllers. +- Revoke OAuth grants when a user revokes an application. +- Refresh project authorizations when transferring groups. +- Stop excess logs from failure to send invite email when group no longer exists. +- Verify confirmed email for OAuth Authorize POST endpoint. +- Fix XSS in Markdown reference tooltips. +- Fix XSS in milestone tooltips. +- Fix xss vulnerability on jobs view. +- Block 40-character hexadecimal branches. +- Prevent a temporary access escalation before group memberships are recalculated when specialized project share workers are enabled. +- Update GitLab Runner Helm Chart to 0.18.2. + ## 13.2.2 (2020-07-29) @@ -1035,7 +1049,20 @@ entry. ## 13.1.6 (2020-08-05) -- No changes. +### Security (11 changes) + +- Add decompressed archive size validation on Project/Group Import. !562 +- Enforce 2FA on Doorkeeper controllers. +- Refresh project authorizations when transferring groups. +- Stop excess logs from failure to send invite email when group no longer exists. +- Verify confirmed email for OAuth Authorize POST endpoint. +- Revoke OAuth grants when a user revokes an application. +- Fix XSS in Markdown reference tooltips. +- Fix XSS in milestone tooltips. +- Fix xss vulnerability on jobs view. +- Block 40-character hexadecimal branches. +- Update GitLab Runner Helm Chart to 0.17.2. + ## 13.1.5 (2020-07-23) @@ -1573,7 +1600,19 @@ entry. ## 13.0.12 (2020-08-05) -- No changes. +### Security (10 changes) + +- Add decompressed archive size validation on Project/Group Import. !562 +- Enforce 2FA on Doorkeeper controllers. +- Refresh project authorizations when transferring groups. +- Stop excess logs from failure to send invite email when group no longer exists. +- Verify confirmed email for OAuth Authorize POST endpoint. +- Revoke OAuth grants when a user revokes an application. +- Fix XSS in Markdown reference tooltips. +- Fix XSS in milestone tooltips. +- Fix xss vulnerability on jobs view. +- Block 40-character hexadecimal branches. + ## 13.0.11 (2020-08-05) diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION index 5cbd1279d16..2c46e56f22d 100644 --- a/GITALY_SERVER_VERSION +++ b/GITALY_SERVER_VERSION @@ -1 +1 @@ -c6fdcae2d1c5d4914a010dfe7ea5dbfcfb8bdabf +1bd1bfa6673eb784b856d580240f8e5522b86467 diff --git a/GITLAB_SHELL_VERSION b/GITLAB_SHELL_VERSION index 74302c5119c..d224e69099c 100644 --- a/GITLAB_SHELL_VERSION +++ b/GITLAB_SHELL_VERSION @@ -1 +1 @@ -13.4.0 +13.5.0 diff --git a/Gemfile b/Gemfile index 9a23c4f7d11..8ef21d1e4e4 100644 --- a/Gemfile +++ b/Gemfile @@ -144,7 +144,7 @@ gem 'deckar01-task_list', '2.3.1' gem 'gitlab-markup', '~> 1.7.1' gem 'github-markup', '~> 1.7.0', require: 'github/markup' gem 'commonmarker', '~> 0.20' -gem 'kramdown', '~> 2.2.1' +gem 'kramdown', '~> 2.3.0' gem 'RedCloth', '~> 4.3.2' gem 'rdoc', '~> 6.1.2' gem 'org-ruby', '~> 0.9.12' diff --git a/Gemfile.lock b/Gemfile.lock index 257cfb6b52c..79f2d31bbf6 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -598,7 +598,7 @@ GEM kgio (2.11.3) knapsack (1.17.0) rake - kramdown (2.2.1) + kramdown (2.3.0) rexml kramdown-parser-gfm (1.1.0) kramdown (~> 2.0) @@ -1308,7 +1308,7 @@ DEPENDENCIES jwt (~> 2.1.0) kaminari (~> 1.0) knapsack (~> 1.17) - kramdown (~> 2.2.1) + kramdown (~> 2.3.0) kubeclient (~> 4.6.0) letter_opener_web (~> 1.3.4) license_finder (~> 5.4) diff --git a/app/assets/javascripts/grafana_integration/components/grafana_integration.vue b/app/assets/javascripts/grafana_integration/components/grafana_integration.vue index 86ac3a5b580..8d1e542b8ad 100644 --- a/app/assets/javascripts/grafana_integration/components/grafana_integration.vue +++ b/app/assets/javascripts/grafana_integration/components/grafana_integration.vue @@ -1,11 +1,11 @@ diff --git a/app/assets/javascripts/snippets/components/snippet_header.vue b/app/assets/javascripts/snippets/components/snippet_header.vue index be4efd10e45..feae17ccc23 100644 --- a/app/assets/javascripts/snippets/components/snippet_header.vue +++ b/app/assets/javascripts/snippets/components/snippet_header.vue @@ -68,6 +68,11 @@ export default { snippetHasBinary() { return Boolean(this.snippet.blobs.find(blob => blob.binary)); }, + authoredMessage() { + return this.snippet.author + ? __('Authored %{timeago} by %{author}') + : __('Authored %{timeago}'); + }, personalSnippetActions() { return [ { @@ -178,8 +183,8 @@ export default { -
- +
+