Shivansh Gargandwxiaoguang f270534e83 fix: validate "scope" for OAuth2, "state" for OpenID (#39642) ...

1. Fixes: https://github.com/go-gitea/gitea/issues/39641
* The OAuth2 authorize/grant endpoint accepted and persisted arbitrary
scope strings without validation, unlike personal access token creation
which rejects unknown scopes. Normalize and validate form.Scope before
creating or updating a grant, ignore invalid scopes
* `// TODO: at the moment invalid tokens are treated as "all" to avoid
breaking 1.22 behavior` is fixed.
2. To avoid CSRF attack for OpenID endpoint, add a state check

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-10-12 20:57:41 +00:00

..

actions

fix(actions): harden log cursor, activity type and actor filter handling (#39721)

2026-10-10 19:52:23 +00:00

agit

fix(pull): refresh commits behind when an AGit pull request is updated (#39613)

2026-10-06 07:21:43 +00:00

asymkey

feat: Add audit logging (#38189)

2026-09-12 08:15:23 +00:00

attachment

chore: misc go 1.27 tweaks (#39069)

2026-08-24 18:26:10 +00:00

audit

feat: Add audit logging (#38189)

2026-09-12 08:15:23 +00:00

auth

fix(auth): avoid "compromised account" false-alarm when login with remember-me token (#39686)

2026-10-12 08:44:52 +00:00

automerge

fix: trace git command correctly (#39520)

2026-10-01 10:01:45 +00:00

automergequeue

refactor(automerge): fix error handling, populate recent automerge tasks on restart (#39001)

2026-08-28 14:17:01 -07:00

context

refactor: remove NotFoundOrServerError (#39727)

2026-10-10 16:34:53 +02:00

contexttest

refactor!: move go-chi/session into Gitea (#39504)

2026-10-02 21:08:14 +02:00

convert

refactor(actions): small cleanups across models, services and routers (#39722)

2026-10-10 12:55:28 +00:00

cron

feat: Add audit logging (#38189)

2026-09-12 08:15:23 +00:00

doctor

refactor: drop two unmaintained dependencies, rename the byte size helpers (#39083)

2026-08-27 15:31:20 +00:00

externalaccount

feat: Add audit logging (#38189)

2026-09-12 08:15:23 +00:00

feed

fix(feed): use meaningful lines as comment excerpt (#39276)

2026-09-25 03:08:15 +00:00

forms

feat(user): allow renaming security keys (webauthn/passkey) (#39413)

2026-10-05 19:12:22 +02:00

git

fix: avoid FetchRemoteTempCommit touching unnecessary resources (#39583)

2026-10-04 22:03:18 -07:00

gitdiff

enhance!: raise minimum git version to 2.34 (#39565)

2026-10-04 16:26:14 +08:00

gitproxy

fix(git)!: use internal proxy for all git operations (#39426)

2026-09-29 14:43:36 +02:00

indexer

…

issue

enhance: allow auto-closing PRs from PRs (#39393)

2026-09-25 11:35:13 +00:00

lfs

chore: fix system users (#39299)

2026-09-12 16:26:20 +00:00

mailer

refactor: "install" page (#39400)

2026-09-23 23:14:31 +00:00

markup

feat: add deploy tokens (#37306)

2026-08-26 19:32:44 +00:00

migrations

fix: add missing checks to several API and web handlers (#39501)

2026-09-30 20:25:14 +02:00

mirror

refactor: only update sync status columns when syncing push mirror (#39517)

2026-10-02 19:28:51 +00:00

notifications

…

notify

…

oauth2_provider

fix: validate "scope" for OAuth2, "state" for OpenID (#39642)

2026-10-12 20:57:41 +00:00

org

feat: Add audit logging (#38189)

2026-09-12 08:15:23 +00:00

packages

fix: package registry keypair creation race (#39319)

2026-09-18 18:30:27 +00:00

projects

…

pubsub

…

pull

fix(pull): refresh commits behind when an AGit pull request is updated (#39613)

2026-10-06 07:21:43 +00:00

release

fix: correct label deletion and release attachment load (#39743)

2026-10-13 01:27:40 +08:00

repository

perf(repo): fetch the initial commit instead of pushing it (#39628)

2026-10-06 14:39:36 +00:00

secrets

refactor(actions): pass secret and variable scope as a struct (#39719)

2026-10-10 18:21:28 +00:00

task

fix: classify git failures on stderr, restrict migration failure detail (#39010)

2026-09-15 10:59:34 +02:00

uinotification

…

user

fix(user): allow unblocking users promoted to admin (#39192)

2026-09-23 16:54:12 +00:00

versioned_migration

…

webhook

fix(webhook): keep line breaks in Telegram rich messages (#39650)

2026-10-08 09:16:17 +00:00

websocket

…

webtheme

…

wiki

enhance!: raise minimum git version to 2.34 (#39565)

2026-10-04 16:26:14 +08:00