Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fail when API & web endpoints use unrelated ids #28212

Closed

Conversation

earl-warren
Copy link
Contributor

This is a copy of a security fix authored by the Forgejo security team that was already sent privately via encrypted email to security@gitea.io during the 30-day embargo period that expired today. This PR is created because security@gitea.io stopped responding since 31/10.

Loïc Dachary added 16 commits November 25, 2023 12:20
…es/pinned

(cherry picked from commit 00fad97fc1b27db40a002c9ab3f709d04dc2cdd1)
(cherry picked from commit a8a0784e3f4cf24973af3c86f9245beee82a9026)
(cherry picked from commit d3db2fa8bc85e9d67f30854bba0a4c1e8b57b015)
(cherry picked from commit e95565a6ad82a1fa5d61f3e02a76f696fcdcbf03)
(cherry picked from commit 7b95266de083c8de0ff224530a9b69e82c52c344)
(cherry picked from commit 30f43dbcd47c80cc2dde2bb23e7f57e9bc7bfa61)
(cherry picked from commit 51c280e877765efe721e607aa95bcbb5aef364e0)
(cherry picked from commit 383b4333cf7aa1165e20d8a9bd2c07e3212b9da8)
(cherry picked from commit f499075c53752f983c6e4f8af17c449926ba94d9)
(cherry picked from commit df1a01507f61790bb89de1f2d4cce474fc3a544e)
(cherry picked from commit a146e3d0f9ff8ac1aee4be8a3632c76b35fc3482)
(cherry picked from commit 2f6dc175aab7541581401b1005b23b054906ee77)
(cherry picked from commit 521eed2312f45bef7de28c9c03c04257862a453c)
(cherry picked from commit 7ef02b03d1fbebf5c1cbae5688381ff732d25391)
(cherry picked from commit 1b57d8493882d9d659164acd3b4a5a99c769d8ed)
(cherry picked from commit ffe70563fed45d384e0a20a1a4be76114a515075)
(cherry picked from commit 385a1f337462bec34ccc389d4efe21e3b2be8465)
(cherry picked from commit 6e45c8d1cb1e55f477dd8f6dc793a7146c9c6675)
(cherry picked from commit 21d4556cbeb9d0f825398114ba3a4816f331315b)
(cherry picked from commit 3cd467f82f570e5a2c3075bdc2ec0c17a998ebb1)
(cherry picked from commit aed193ef9f5d59aed12cfd7518765d5598c7999f)
(cherry picked from commit 12c8414d84c9c15b066652dbae04f48d02882494)
…istory/soft-delete

(cherry picked from commit a11d82a42729eba02032310f7778a9197f4f8ead)
(cherry picked from commit 020e2983bb1229f27538872842c955c8c3992461)
…story/detail

(cherry picked from commit 0853dec293dd632a03948f66af69e75dd582a92d)
(cherry picked from commit 8078a3d400e719e95277a9fcc452b4101e40002a)
(cherry picked from commit a6d2ad6310f754952998fd73118da9f91c563145)
(cherry picked from commit 921256ccb15c1cc31da25196235e94c6ab1bb9e3)
(cherry picked from commit 768238d9f9982e99ad4cbf3942d2d2db5126a150)

Conflicts:
	routers/api/v1/repo/key.go
	trivial context conflict
(cherry picked from commit a6627d18257fbc601e459ff4a6a6a0c1da1eabb5)
(cherry picked from commit 7eda733ed6a22c08a85fdc90deec0c440427cef7)
(cherry picked from commit 2f9ba33d6dbece0836de7ddabc335a61e52c268c)
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Nov 25, 2023
@GiteaBot GiteaBot added this to the 1.21.1 milestone Nov 25, 2023
@pull-request-size pull-request-size bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Nov 25, 2023
@github-actions github-actions bot added the modifies/api This PR adds API routes or modifies them label Nov 25, 2023
@lunny
Copy link
Member

lunny commented Nov 25, 2023

replaced by #28213

@lunny lunny closed this Nov 25, 2023
@GiteaBot GiteaBot removed this from the 1.21.1 milestone Nov 25, 2023
@go-gitea go-gitea locked as resolved and limited conversation to collaborators Feb 23, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. modifies/api This PR adds API routes or modifies them size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants