Skip to content

Commit e81255c

Browse files
OctomergerOctomerger
authored
repo sync
2 parents 4363457 + 77d0bdc commit e81255c

10 files changed

Lines changed: 362 additions & 2 deletions

File tree

‎data/graphql/ghae/schema.docs-ghae.graphql‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5113,6 +5113,61 @@ type CreateDeploymentStatusPayload @preview(toggledBy: "flash-preview") {
51135113
deploymentStatus: DeploymentStatus
51145114
}
51155115

5116+
"""
5117+
Autogenerated input type of CreateEnterpriseOrganization
5118+
"""
5119+
input CreateEnterpriseOrganizationInput {
5120+
"""
5121+
The logins for the administrators of the new organization.
5122+
"""
5123+
adminLogins: [String!]!
5124+
5125+
"""
5126+
The email used for sending billing receipts.
5127+
"""
5128+
billingEmail: String!
5129+
5130+
"""
5131+
A unique identifier for the client performing the mutation.
5132+
"""
5133+
clientMutationId: String
5134+
5135+
"""
5136+
The ID of the enterprise owning the new organization.
5137+
"""
5138+
enterpriseId: ID! @possibleTypes(concreteTypes: ["Enterprise"])
5139+
5140+
"""
5141+
The login of the new organization.
5142+
"""
5143+
login: String!
5144+
5145+
"""
5146+
The profile name of the new organization.
5147+
"""
5148+
profileName: String!
5149+
}
5150+
5151+
"""
5152+
Autogenerated return type of CreateEnterpriseOrganization
5153+
"""
5154+
type CreateEnterpriseOrganizationPayload {
5155+
"""
5156+
A unique identifier for the client performing the mutation.
5157+
"""
5158+
clientMutationId: String
5159+
5160+
"""
5161+
The enterprise that owns the created organization.
5162+
"""
5163+
enterprise: Enterprise
5164+
5165+
"""
5166+
The organization that was created.
5167+
"""
5168+
organization: Organization
5169+
}
5170+
51165171
"""
51175172
Autogenerated input type of CreateIpAllowListEntry
51185173
"""
@@ -14399,6 +14454,16 @@ type Mutation {
1439914454
input: CreateDeploymentStatusInput!
1440014455
): CreateDeploymentStatusPayload @preview(toggledBy: "flash-preview")
1440114456

14457+
"""
14458+
Creates an organization as part of an enterprise account.
14459+
"""
14460+
createEnterpriseOrganization(
14461+
"""
14462+
Parameters for CreateEnterpriseOrganization
14463+
"""
14464+
input: CreateEnterpriseOrganizationInput!
14465+
): CreateEnterpriseOrganizationPayload
14466+
1440214467
"""
1440314468
Creates a new IP allow list entry.
1440414469
"""
@@ -24788,6 +24853,11 @@ type Release implements Node & UniformResourceLocatable {
2478824853
"""
2478924854
tag: Ref
2479024855

24856+
"""
24857+
The tag commit for this release.
24858+
"""
24859+
tagCommit: Commit
24860+
2479124861
"""
2479224862
The name of the release's Git tag
2479324863
"""
@@ -36576,6 +36646,11 @@ type User implements Actor & Node & ProfileOwner & ProjectOwner & RepositoryOwne
3657636646
"""
3657736647
isEmployee: Boolean!
3657836648

36649+
"""
36650+
Whether or not this user is a member of the GitHub Stars Program.
36651+
"""
36652+
isGitHubStar: Boolean!
36653+
3657936654
"""
3658036655
Whether or not the user has marked themselves as for hire.
3658136656
"""

‎data/graphql/schema.docs.graphql‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27087,6 +27087,11 @@ type Release implements Node & UniformResourceLocatable {
2708727087
"""
2708827088
tag: Ref
2708927089

27090+
"""
27091+
The tag commit for this release.
27092+
"""
27093+
tagCommit: Commit
27094+
2709027095
"""
2709127096
The name of the release's Git tag
2709227097
"""
@@ -39959,6 +39964,11 @@ type User implements Actor & Node & PackageOwner & ProfileOwner & ProjectOwner &
3995939964
"""
3996039965
isEmployee: Boolean!
3996139966

39967+
"""
39968+
Whether or not this user is a member of the GitHub Stars Program.
39969+
"""
39970+
isGitHubStar: Boolean!
39971+
3996239972
"""
3996339973
Whether or not the user has marked themselves as for hire.
3996439974
"""

‎data/release-notes/2-20/24.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
date: '2021-03-02'
2+
sections:
3+
security_fixes:
4+
- '**HIGH:** An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability has been assigned CVE-2021-22861. This issue was reported via the [GitHub Bug Bounty Program](https://bounty.github.com).'
5+
- '**HIGH:** An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability has been assigned CVE-2021-22863. This issue was reported via the [GitHub Bug Bounty Program](https://bounty.github.com).'
6+
- '**HIGH:** A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability has been assigned CVE-2020-10519.'
7+
- '**LOW:** A specially crafted request to the SVN bridge could trigger a long wait before failure resulting in Denial of Service (DoS).'
8+
- 'Packages have been updated to the latest security versions.'
9+
bugs:
10+
- 'An informational message was unintentionally logged as an error during GitHub Enterprise Backup Utilities snapshots, which resulted in unnecessary emails being sent when backups were scheduled by cron jobs that listen for output to stderr.'
11+
- 'While restoring a large backup, exception logging related to Redis memory exhaustion could cause the restore to fail due to a full disk.'
12+
- 'When editing a wiki page a user could experience a 500 error when clicking the Save button.'
13+
- 'An S/MIME signed commit using a certificate with multiple names in the subject alternative name would incorrectly show as "Unverified" in the commit badge.'
14+
- 'Suspended user was sent emails when added to a team.'
15+
- 'When uploading a new license file with a different number of seats from the previous license file, the seat difference was not correctly represented in the enterprise account Settings -> License page.'
16+
- 'The "Prevent repository admins from changing anonymous Git read access" checkbox available in the enterprise account settings could not be successfully enabled or disabled.'
17+
- 'During a leap year, the user was getting a 404 response when trying to view Contribution activity on a Monday.'
18+
changes:
19+
- 'Added support for [AWS EC2 r5b instance types](https://aws.amazon.com/about-aws/whats-new/2020/12/introducing-new-amazon-ec2-r5b-instances-featuring-60-gbps-of-ebs-bandwidth-and-260K-iops/).'
20+
- 'Adjusted background queue prioritization to more evenly distribute jobs.'
21+
known_issues:
22+
- 'On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.'
23+
- 'Custom firewall rules are not maintained during an upgrade.'
24+
- 'Git LFS tracked files [uploaded through the web interface](https://github.com/blog/2105-upload-files-to-your-repositories) are incorrectly added directly to the repository.'
25+
- 'Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.'
26+
- 'When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.'
27+
- 'Security alerts are not reported when pushing to a repository on the command line.'

‎data/release-notes/2-21/15.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
date: '2021-03-02'
2+
sections:
3+
security_fixes:
4+
- '**HIGH:** An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability has been assigned CVE-2021-22861. This issue was reported via the [GitHub Bug Bounty Program](https://bounty.github.com).'
5+
- '**HIGH:** An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability has been assigned CVE-2021-22863. This issue was reported via the [GitHub Bug Bounty Program](https://bounty.github.com).'
6+
- '**HIGH:** A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability has been assigned CVE-2020-10519.'
7+
- '**MEDIUM:** GitHub Tokens from GitHub Pages builds could end up in logs.'
8+
- '**LOW:** A specially crafted request to the SVN bridge could trigger a long wait before failure resulting in Denial of Service (DoS).'
9+
- 'Packages have been updated to the latest security versions.'
10+
bugs:
11+
- 'The load-balancer health checks in some cases could cause the babeld logs to fill up with errors about the PROXY protocol.'
12+
- 'An informational message was unintentionally logged as an error during GitHub Enterprise Backup Utilities snapshots, which resulted in unnecessary emails being sent when backups were scheduled by cron jobs that listen for output to stderr.'
13+
- 'While restoring a large backup, exception logging related to Redis memory exhaustion could cause the restore to fail due to a full disk.'
14+
- 'When editing a wiki page a user could experience a 500 error when clicking the Save button.'
15+
- 'An S/MIME signed commit using a certificate with multiple names in the subject alternative name would incorrectly show as "Unverified" in the commit badge.'
16+
- 'Suspended user was sent emails when added to a team.'
17+
- 'When a repository had a large number of manifests an error `You have reached the maximum number of allowed manifest files (20) for this repository.` was shown on the Insights -> Dependency graph tab. For more information, see [Visualization limits](https://docs.github.com/en/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies#are-there-limits-which-affect-the-dependency-graph-data).'
18+
- 'When uploading a new license file with a different number of seats from the previous license file, the seat difference was not correctly represented in the enterprise account Settings -> License page.'
19+
- 'The "Prevent repository admins from changing anonymous Git read access" checkbox available in the enterprise account settings could not be successfully enabled or disabled.'
20+
- 'When a GitHub Pages build failed, the email notification contained an incorrect link for support location.'
21+
- 'During a leap year, the user was getting a 404 response when trying to view Contribution activity on a Monday.'
22+
- 'Visiting the *Explore* section failed with a 500 Internal Server error.'
23+
changes:
24+
- 'Added support for [AWS EC2 r5b instance types](https://aws.amazon.com/about-aws/whats-new/2020/12/introducing-new-amazon-ec2-r5b-instances-featuring-60-gbps-of-ebs-bandwidth-and-260K-iops/).'
25+
- 'Adjusted background queue prioritization to more evenly distribute jobs.'
26+
known_issues:
27+
- 'On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.'
28+
- 'Custom firewall rules are not maintained during an upgrade.'
29+
- 'Git LFS tracked files [uploaded through the web interface](https://github.com/blog/2105-upload-files-to-your-repositories) are incorrectly added directly to the repository.'
30+
- 'Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.'
31+
- 'When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.'
32+
- 'Security alerts are not reported when pushing to a repository on the command line.'

‎data/release-notes/2-22/7.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
date: '2021-03-02'
2+
sections:
3+
security_fixes:
4+
- '**HIGH:** An improper access control vulnerability was identified in GitHub Enterprise Server that allowed authenticated users of the instance to gain write access to unauthorized repositories via specifically crafted pull requests and REST API requests. An attacker would need to be able to fork the targeted repository, a setting that is disabled by default for organization owned private repositories. Branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability has been assigned CVE-2021-22861. This issue was reported via the [GitHub Bug Bounty Program](https://bounty.github.com).'
5+
- '**HIGH:** An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authenticated users of the instance to modify the maintainer collaboration permission of a pull request without proper authorization. By exploiting this vulnerability, an attacker would be able to gain access to head branches of pull requests opened on repositories of which they are a maintainer. Forking is disabled by default for organization owned private repositories and would prevent this vulnerability. Additionally, branch protections such as required pull request reviews or status checks would prevent unauthorized commits from being merged without further review or validation. This vulnerability has been assigned CVE-2021-22863. This issue was reported via the [GitHub Bug Bounty Program](https://bounty.github.com).'
6+
- '**HIGH:** A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability has been assigned CVE-2020-10519.'
7+
- '**MEDIUM:** GitHub Tokens from GitHub Pages builds could end up in logs.'
8+
- '**LOW:** A specially crafted request to the SVN bridge could trigger a long wait before failure resulting in Denial of Service (DoS).'
9+
- 'Packages have been updated to the latest security versions.'
10+
bugs:
11+
- 'The load-balancer health checks in some cases could cause the babeld logs to fill up with errors about the PROXY protocol.'
12+
- 'An informational message was unintentionally logged as an error during GitHub Enterprise Backup Utilities snapshots, which resulted in unnecessary emails being sent when backups were scheduled by cron jobs that listen for output to stderr.'
13+
- 'While restoring a large backup, exception logging related to Redis memory exhaustion could cause the restore to fail due to a full disk.'
14+
- 'When first setting up a new instance, if you selected "Configure as Replica" you would be unable to start replication.'
15+
- 'When GitHub Actions was enabled, disabling maintenance mode in the management console failed.'
16+
- 'When editing a wiki page a user could experience a 500 error when clicking the Save button.'
17+
- 'An S/MIME signed commit using a certificate with multiple names in the subject alternative name would incorrectly show as "Unverified" in the commit badge.'
18+
- 'Suspended user was sent emails when added to a team.'
19+
- 'User saw 500 error when executing git operations on an instance configured with LDAP authentication.'
20+
- 'The `remove_org_member_package_access` background job was visible in the management console and would continually increase.'
21+
- 'When a repository had a large number of manifests an error `You have reached the maximum number of allowed manifest files (20) for this repository.` was shown on the Insights -> Dependency graph tab. For more information, see [Visualization limits](https://docs.github.com/en/github/managing-security-vulnerabilities/troubleshooting-the-detection-of-vulnerable-dependencies#are-there-limits-which-affect-the-dependency-graph-data).'
22+
- 'When uploading a new license file with a different number of seats from the previous license file, the seat difference was not correctly represented in the enterprise account Settings -> License page.'
23+
- 'The "Prevent repository admins from changing anonymous Git read access" checkbox available in the enterprise account settings could not be successfully enabled or disabled.'
24+
- 'When a GitHub Pages build failed, the email notification contained an incorrect link for support location.'
25+
- 'During a leap year, the user was getting a 404 response when trying to view Contribution activity on a Monday.'
26+
changes:
27+
- 'Added support for [AWS EC2 r5b instance types](https://aws.amazon.com/about-aws/whats-new/2020/12/introducing-new-amazon-ec2-r5b-instances-featuring-60-gbps-of-ebs-bandwidth-and-260K-iops/).'
28+
- 'Adjusted background queue prioritization to more evenly distribute jobs.'
29+
known_issues:
30+
- 'On a freshly set up GitHub Enterprise Server without any users, an attacker could create the first admin user.'
31+
- 'Custom firewall rules are not maintained during an upgrade.'
32+
- 'Git LFS tracked files [uploaded through the web interface](https://github.com/blog/2105-upload-files-to-your-repositories) are incorrectly added directly to the repository.'
33+
- 'Issues cannot be closed if they contain a permalink to a blob in the same repository where the file path is longer than 255 characters.'
34+
- 'When "Users can search GitHub.com" is enabled with GitHub Connect, issues in private and internal repositories are not included in GitHub.com search results.'

0 commit comments

Comments
 (0)