Restrict viewing of What's new on self-managed to authenticated users
Problem
Version info leak?
Unsure if this was intentional, but I assume it isn't.
There have clearly been attempts at shoring up Gitlab from revealing versions without authentication. The API blocks the calls to api/v4/version, and all documentation suggests you need to be authenticated to glean the version.
However, while unauthenticated and via the 'explore' menu option:
Help->What's New shows the version of gitlab.
Proposed solution
Restrict viewing of What's new
on self-managed to authenticated users.
See also
While displayed version is being removed in #325591 (closed), this issue will remove access altogether for unauthenticated users so the version cannot be inferred based on the content of What's new
.
Edited by Phil Calder