gitea

mirror of https://github.com/go-gitea/gitea.git synced 2026-06-14 13:18:05 +02:00

History

Nicolas f25811942c

fix: re-check branch write permission for every ref in a push

The pre-receive hook cached the result of CanWriteCode() after the first
ref in a batch push, but CanMaintainerWriteToBranch depends on the current
branch name. A user holding a per-branch maintainer-edit grant (an open PR
with "allow edits from maintainers") could batch that branch with protected
branches or tags and have the cached approval reused, escalating to full
repository write. Evaluate the permission fresh for every ref; the pusher
and base permission remain cached via loadPusherAndPermission.

Assisted-by: Claude:claude-opus-4-8

2026-06-13 18:38:06 +02:00

api

fix: block fork sync when base repo is no longer readable

2026-06-13 17:36:35 +02:00

common

fix(actions): return 404 when job log blob is missing (#38003 )

2026-06-05 20:10:25 +02:00

install

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )

2026-05-26 15:49:31 -07:00

private

fix: re-check branch write permission for every ref in a push