Skip to content

Restrict viewing of What's new on self-managed to authenticated users

Problem

Version info leak?

Unsure if this was intentional, but I assume it isn't.

There have clearly been attempts at shoring up Gitlab from revealing versions without authentication. The API blocks the calls to api/v4/version, and all documentation suggests you need to be authenticated to glean the version.

However, while unauthenticated and via the 'explore' menu option:

Help->What's New shows the version of gitlab.

version_leak

Proposed solution

Restrict viewing of What's new on self-managed to authenticated users.

See also

While displayed version is being removed in #325591 (closed), this issue will remove access altogether for unauthenticated users so the version cannot be inferred based on the content of What's new.

Edited by Phil Calder