4 people 565e12d47b fix(attachments): enforce owning repository path (#39048) (#39077) ...

Backport #39048 by @bircni

Reject attachment requests routed through a repository other than the
attachment owner.

Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>

2026-08-24 11:11:53 -07:00

..

admin

chore: fix form string abuse (#38106)

2026-06-14 18:26:22 +00:00

auth

fix(auth): set WebAuthn user verification per request (#38810)

2026-08-08 10:11:04 +00:00

devtest

fix(actions): Fix how jobs in matrixes are grouped (#38980) (#38998)

2026-08-20 17:39:47 +02:00

events

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

explore

chore: fix form string abuse (#38106)

2026-06-14 18:26:22 +00:00

feed

fix: various security fixes (#38406) (#38426)

2026-07-12 17:41:58 +00:00

healthcheck

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

misc

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

org

refactor: external render (#38885) (#38898)

2026-08-12 23:17:39 -07:00

repo

fix(attachments): enforce owning repository path (#39048) (#39077)

2026-08-24 11:11:53 -07:00

shared

fix(issues): sort scoped labels by exclusive order in dropdowns (#38893) (#38954)

2026-08-17 19:23:37 +00:00

user

fix(ui): respect FEED_PAGING_NUM on the dashboard feed (#38935) (#38936)

2026-08-15 14:15:05 +02:00

base.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

githttp.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

goget.go

fix: various security fixes (#38406) (#38426)

2026-07-12 17:41:58 +00:00

home.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

metrics.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

nodeinfo.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

passkey.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

swagger_json.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

web.go

fix: allow anonymous theme switching when REQUIRE_SIGNIN_VIEW is set (#38956) (#38961)

2026-08-18 07:24:18 +02:00

webfinger.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00