From bc3666c98a16baf1a097ab246c93c085c5dba110 Mon Sep 17 00:00:00 2001 From: James Phillips Date: Wed, 20 Dec 2017 19:53:39 -0800 Subject: [PATCH] Updates the change log. --- CHANGELOG.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1f0eac027..bb65d50b0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ ## 1.0.3 (UNRELEASED) +SECURITY: + +ui: Patched handlebars JS to escape `=` to prevent potential XSS issues. [[GH-3733](https://github.com/hashicorp/consul/issues/3733)] + BREAKING CHANGES: agent: Updated Consul's HTTP server to ban all URLs containing non-printable characters (a bad request status will be returned for these cases). This affects some user-facing areas like key/value entry key names which are carried in URLs. [[GH-3762](https://github.com/hashicorp/consul/issues/3762)] @@ -70,7 +74,7 @@ BUG FIXES: SECURITY: -* Fixed an XSS issue with Consul's built-in web UI where node names were not being properly escaped. [[GH-3578](https://github.com/hashicorp/consul/issues/3578)] +* ui: Fixed an XSS issue with Consul's built-in web UI where node names were not being properly escaped. [[GH-3578](https://github.com/hashicorp/consul/issues/3578)] BREAKING CHANGES: