0964106988
fix: add missing access checks and size limits ( #39942 ) ( #40085 )
...
Backport https://github.com/go-gitea/gitea/pull/39942
Several handlers and parsers skipped checks that their siblings already
perform.
- Reject issue, comment, label, milestone and release mutations in
archived repositories via the API with one guard per route group,
matching the web UI
- Hide timeline references and dependencies pointing at issues the doer
cannot read, in the web UI and the API, including pull requests of the
same repository without pull request access
- Reject workflow runs with more than `MaxJobNumPerRun` jobs, including
inline reusable workflow jobs, and show rejected pushes as invalid
workflow runs
- Bound how much of a Helm chart archive is inflated while looking for
`Chart.yaml`
`release/v28` lacks two helpers this needs, so they are included:
`insertInvalidWorkflowRun`, split out of `handleInvalidWorkflows` by
https://github.com/go-gitea/gitea/pull/39480 , and
`packages.NewLimitedReader` from
https://github.com/go-gitea/gitea/pull/39366 .
Co-authored-by: bircni <bircni@icloud.com >
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
2026-10-30 08:08:32 +01:00
..
2026-04-23 15:18:53 +00:00
2026-07-20 03:42:02 +00:00
2026-09-26 22:52:19 +00:00
2026-09-26 07:42:36 +00:00
2026-09-29 04:36:33 +00:00
2026-10-03 08:21:46 +00:00
2026-08-07 20:56:40 -07:00
2026-09-25 00:06:42 +02:00
2026-05-26 15:49:31 -07:00
2026-09-25 00:06:42 +02:00
2026-09-26 08:01:41 +00:00
2026-09-25 00:06:42 +02:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-08-07 20:56:40 -07:00
2026-08-07 20:56:40 -07:00
2026-09-27 18:30:42 +00:00
2026-09-29 04:36:33 +00:00
2026-08-07 20:56:40 -07:00
2026-07-15 02:36:03 +00:00
2026-07-25 21:31:19 +00:00
2026-08-07 20:56:40 -07:00
2026-10-14 22:47:59 +00:00
2026-08-07 20:56:40 -07:00
2026-05-26 15:49:31 -07:00
2026-09-12 08:15:23 +00:00
2026-05-26 15:49:31 -07:00
2026-09-18 12:43:36 +00:00
2026-06-27 12:09:01 +00:00
2026-08-29 07:50:04 +00:00
2026-10-03 19:19:44 +00:00
2026-10-24 15:06:46 +02:00
2026-10-10 20:23:39 +00:00
2026-05-26 15:49:31 -07:00
2026-10-10 20:23:39 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-08-22 09:29:25 +02:00
2026-09-16 17:34:41 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-08-31 23:31:17 +00:00
2026-05-26 15:49:31 -07:00
2026-06-10 17:34:10 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-09-06 09:49:27 +00:00
2026-08-09 10:25:06 +00:00
2026-09-30 18:46:59 +00:00
2026-08-17 20:30:24 +00:00
2026-10-30 08:08:32 +01:00
2026-10-22 21:40:40 +00:00
2026-05-26 15:49:31 -07:00
2026-10-21 17:59:21 +02:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-08-17 20:30:24 +00:00
2026-10-30 08:08:32 +01:00
2026-07-12 17:14:09 +00:00
2026-08-26 19:32:44 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-17 06:39:22 +00:00
2026-08-23 07:23:16 +00:00
2026-07-16 11:51:36 +02:00
2026-05-26 15:49:31 -07:00
2026-07-28 17:04:22 +00:00
2026-05-26 15:49:31 -07:00
2026-08-24 07:28:17 +00:00
2026-08-09 10:25:06 +00:00
2026-05-26 15:49:31 -07:00
2026-09-23 18:45:56 +00:00
2026-05-26 15:49:31 -07:00
2026-08-17 17:43:34 +00:00
2026-07-12 17:14:09 +00:00
2026-05-26 15:49:31 -07:00
2026-08-09 12:55:43 +00:00
2026-08-09 10:25:06 +00:00
2026-10-01 08:09:21 +00:00
2026-08-24 07:28:17 +00:00
2026-08-07 11:49:23 +00:00
2026-08-09 10:25:06 +00:00
2026-08-24 07:28:17 +00:00
2026-08-24 07:28:17 +00:00
2026-08-28 05:15:55 +00:00
2026-08-24 18:26:10 +00:00
2026-08-17 20:30:24 +00:00
2026-08-24 07:28:17 +00:00
2026-08-26 19:32:44 +00:00
2026-08-17 20:30:24 +00:00
2026-10-21 05:58:07 +00:00
2026-05-26 15:49:31 -07:00
2026-09-26 16:51:55 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-08-24 07:28:17 +00:00
2026-05-26 15:49:31 -07:00
2026-06-17 06:39:22 +00:00
2026-06-03 16:21:48 -07:00
2026-05-26 15:49:31 -07:00
2026-08-21 07:06:56 +00:00
2026-08-26 20:12:53 +08:00
2026-09-29 14:43:36 +02:00
2026-08-03 06:41:27 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-09-30 18:46:59 +00:00
2026-05-26 15:49:31 -07:00
2026-08-03 06:41:27 +00:00
2026-08-20 15:57:17 +00:00
2026-07-28 17:04:22 +00:00
2026-08-03 06:41:27 +00:00
2026-08-03 06:41:27 +00:00
2026-05-26 15:49:31 -07:00
2026-08-05 17:19:31 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-09-19 13:04:53 +00:00
2026-05-26 15:49:31 -07:00
2026-07-12 17:14:09 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-09-29 14:43:36 +02:00
2026-07-31 11:05:41 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-08-23 06:35:55 +00:00
2026-09-29 14:43:36 +02:00
2026-09-08 09:28:57 +00:00
2026-05-26 15:49:31 -07:00
2026-08-21 07:28:23 +00:00
2026-05-26 15:49:31 -07:00
2026-10-06 05:02:08 +00:00
2026-05-26 15:49:31 -07:00
2026-06-14 20:05:18 +02:00
2026-07-12 17:14:09 +00:00
2026-06-17 16:06:51 +00:00
2026-06-17 06:39:22 +00:00
2026-05-26 15:49:31 -07:00
2026-09-16 17:34:41 +00:00
2026-05-26 15:49:31 -07:00
2026-10-21 05:58:07 +00:00
2026-05-26 15:49:31 -07:00
2026-06-08 16:58:42 +08:00
2026-08-22 23:11:04 -07:00
2026-05-26 15:49:31 -07:00
2026-07-16 17:38:33 +00:00
2026-05-26 15:49:31 -07:00
2026-07-10 19:30:43 +02:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-08-22 08:08:36 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-08-24 17:32:23 +00:00
2026-08-14 02:15:33 +00:00
2026-08-09 10:25:06 +00:00
2023-06-29 23:22:55 +00:00
2026-07-08 00:16:32 +00:00
2026-07-20 16:07:38 +00:00
2026-06-29 15:10:47 +00:00
2026-07-28 17:04:22 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-18 12:02:11 +00:00
2026-08-26 19:32:44 +00:00
2026-09-26 07:42:36 +00:00
2026-09-29 14:43:36 +02:00
2026-10-26 22:39:01 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-10-29 10:04:51 +00:00
2026-10-21 05:58:07 +00:00
2026-09-06 09:49:27 +00:00
2026-07-20 16:07:38 +00:00
2026-05-26 15:49:31 -07:00
2026-10-06 11:27:16 +00:00
2026-09-30 18:46:59 +00:00
2026-09-23 08:51:58 +00:00
2026-05-26 15:49:31 -07:00
2026-10-08 12:30:59 +00:00
2026-08-29 19:54:07 +00:00
2026-10-18 19:50:36 +02:00
2026-06-18 12:02:11 +00:00
2026-08-09 10:25:06 +00:00
2026-09-23 14:34:19 +00:00
2026-07-12 17:14:09 +00:00
2026-10-27 03:14:59 +08:00
2026-05-26 15:49:31 -07:00
2026-07-31 11:05:41 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-08-26 17:24:07 +02:00
2026-10-04 15:51:14 +08:00
2026-10-16 21:22:02 +02:00
2026-08-11 18:01:02 +02:00
2026-09-29 14:43:36 +02:00
2026-09-29 14:43:36 +02:00
2026-09-29 14:43:36 +02:00
2026-05-26 15:49:31 -07:00
2026-08-09 10:25:06 +00:00
2026-10-21 05:58:07 +00:00
2026-08-21 07:28:23 +00:00
2026-05-26 15:49:31 -07:00
2026-08-17 20:30:24 +00:00
2026-05-26 15:49:31 -07:00
2026-08-17 20:30:24 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2022-09-02 15:18:23 -04:00
2026-05-26 15:49:31 -07:00
2026-10-24 06:24:46 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-09-02 17:07:04 +00:00
2026-09-12 11:56:25 +00:00
2026-10-01 10:19:33 +00:00
2026-09-08 15:59:06 +00:00
2026-10-06 17:49:17 +00:00
2026-07-20 16:07:38 +00:00
2026-08-22 08:59:37 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-09-16 12:30:22 +02:00
2026-08-10 01:25:31 +00:00
2026-05-26 15:49:31 -07:00
2026-09-23 14:34:19 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-08-23 06:59:58 +00:00
2026-06-17 16:06:51 +00:00
2026-05-26 15:49:31 -07:00
2026-08-17 07:59:41 +00:00
2026-05-26 15:49:31 -07:00
2026-09-24 09:17:25 +00:00
2026-10-18 19:50:36 +02:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-09-27 18:30:42 +00:00
2026-08-03 06:41:27 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-08-18 04:02:52 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-08-27 16:34:44 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-09-12 08:15:23 +00:00
2026-08-17 18:17:16 +00:00
2026-10-18 19:50:36 +02:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-08-07 00:11:34 +00:00
2026-06-06 11:06:08 +00:00
2026-06-11 17:12:30 +00:00