Skip to content

Check for permission when fetching user controlled issues (#20133) #20196

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
6543 merged 2 commits into from
Jul 1, 2022
Merged

Check for permission when fetching user controlled issues (#20133) #20196

6543 merged 2 commits into from
Jul 1, 2022

Conversation

@Gusted
Copy link
Contributor

@Gusted Gusted commented Jul 1, 2022

Check for permission when fetching user controlled issues (go-gitea#2…
8abde9a 
…0133)

- Backport go-gitea#20133
  - Check correctly for permission when we fetch a new issue(via ID)
is controlled by the user.
@Gusted Gusted added this to the 1.16.9 milestone Jul 1, 2022
@Gusted Gusted added the type/bug label Jul 1, 2022
@GiteaBot GiteaBot added the lgtm/need 1 This PR needs approval from one additional maintainer to be merged. label Jul 1, 2022
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Jul 1, 2022
@6543 6543 merged commit 6162fb0 into go-gitea:release/v1.16 Jul 1, 2022
@6543 6543 added the topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! label Jul 12, 2022
@Gusted Gusted deleted the backport-116-20133 branch July 13, 2022 06:20
freebsd-git pushed a commit to freebsd/freebsd-ports that referenced this pull request Aug 5, 2022
@stblassitude @nunotexbsd
security/vuxml: Document Gitea multiple vulnerabilities
c15a234 
 - Add write check for creating Commit status
   go-gitea/gitea#20334

 - Check for permission when fetching user controlled issues
   go-gitea/gitea#20196

PR:		265526
@go-gitea go-gitea locked and limited conversation to collaborators May 3, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@6543 6543 6543 approved these changes

+1 more reviewer

@a1012112796 a1012112796 a1012112796 approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! type/bug

Projects

None yet

Milestone

1.16.9

Development

Successfully merging this pull request may close these issues.

4 participants

@Gusted @6543 @a1012112796 @GiteaBot