3 people d4ecd5eadf fix(api): check unit read permission in issue sub-resource endpoints (#39885) ...

Several `/repos/{owner}/{repo}/issues/{index}/...` API endpoints load
the issue by index without checking
`CanReadIssuesOrPulls(issue.IsPull)`, unlike `GetIssue`,
`ListIssueComments` and `GetIssueReactions`. The route group's
`mustEnableIssuesOrPulls` passes when the caller can read either unit,
so someone who can read issues but not pull requests (a team with only
the Issues unit, or per-unit anonymous access on a public repo) can read
a pull request's whole conversation through `/timeline`, plus its
labels, subscribers, attachments and tracked times, and can subscribe to
it. The reverse holds for issues.

These handlers now return 404 in that case, like their siblings.

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-10-22 12:04:20 +02:00

..

api

fix(api): check unit read permission in issue sub-resource endpoints (#39885)

2026-10-22 12:04:20 +02:00

common

fix(api): keep milestone due date when it is omitted in edit request (#39869)

2026-10-21 18:52:33 +08:00

install

refactor: "install" page (#39400)

2026-09-23 23:14:31 +00:00

private

feat(repo): allow deleting protected branches (#39243)

2026-10-14 07:19:49 +00:00

utils

Refactor flash message and remove SanitizeHTML template func (#37179)

2026-04-12 10:17:25 +08:00

web

fix(oauth2): decode form-encoded client credentials in HTTP Basic auth (#39926)

2026-10-22 04:18:43 +00:00

init.go

refactor!: remove go-git backend (#39487)

2026-10-03 10:04:24 +00:00