Giteabot 2d58c8c3df fix: add missing checks to several API and web handlers (#39501) (#39507) ...

Backport #39501 by @silverwind

Several handlers skipped checks that their sibling routes or settings
already enforce. This brings them in line.

- Push mirror API honors `DISABLE_NEW_PUSH` and checks the caller's
permission
- Media API serves small files with the usual content headers
- Issue attachment API ignores comment attachments
- Push-to-create respects `FORCE_PRIVATE`
- Profile feeds and follow actions respect `ENABLE_FEED` and owner
visibility
- Tag delete route refuses release tags
- Refresh token grant only accepts refresh tokens
- Gitea migrations bound the source's page size

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: bircni <bircni@icloud.com>

2026-09-30 18:46:59 +00:00

..

actions

fix(httplib): prevent leaking localhost:3000 in public links (#39217)

2026-09-02 19:32:33 +00:00

packages

fix: npm route (#39488) (#39490)

2026-09-30 12:08:14 +00:00

v1

fix: add missing checks to several API and web handlers (#39501) (#39507)

2026-09-30 18:46:59 +00:00