bircni f7fd510224 fix(release): gate draft release attachments on web download endpoints (#38318) ...

Draft-release access control was enforced only on the API release
endpoints (`/api/v1/repos/{owner}/{repo}/releases/...`) but not on the
UUID-based web attachment endpoints (`/attachments/{uuid}`,
`/{owner}/{repo}/attachments/{uuid}`,
`/{owner}/{repo}/releases/attachments/{uuid}`).

Anyone who obtained an attachment UUID — including unauthenticated
callers — could download files belonging to a hidden draft release,
since `ServeAttachment` only checked repo-level read permission and
never the release's draft state.

2026-07-03 20:07:37 +02:00

..

e2e

…

fuzz

…

gitea-lfs-meta

…

gitea-repositories-meta

…

integration

fix(release): gate draft release attachments on web download endpoints (#38318)

2026-07-03 20:07:37 +02:00

testdata/data

…

mssql.ini.tmpl

…

mysql.ini.tmpl

…

pgsql.ini.tmpl

…

sqlite.ini.tmpl

…

test_utils.go

…