bircni f7fd510224 fix(release): gate draft release attachments on web download endpoints (#38318) ...

Draft-release access control was enforced only on the API release
endpoints (`/api/v1/repos/{owner}/{repo}/releases/...`) but not on the
UUID-based web attachment endpoints (`/attachments/{uuid}`,
`/{owner}/{repo}/attachments/{uuid}`,
`/{owner}/{repo}/releases/attachments/{uuid}`).

Anyone who obtained an attachment UUID — including unauthenticated
callers — could download files belonging to a hidden draft release,
since `ServeAttachment` only checked repo-level read permission and
never the release's draft state.

2026-07-03 20:07:37 +02:00

..

_mock_data/Test_MigrateFromGiteaToGitea

…

migration-test

…

actions_approve_test.go

…

actions_concurrency_test.go

…

actions_concurrent_claim_test.go

…

actions_delete_run_test.go

…

actions_inputs_test.go

…

actions_job_test.go

…

actions_job_token_test.go

…

actions_list_filter_test.go

…

actions_log_finalize_test.go

…

actions_log_test.go

…

actions_rerun_test.go

…

actions_reusable_workflow_test.go

…

actions_route_test.go

…

actions_runner_modify_test.go

…

actions_runner_test.go

…

actions_schedule_test.go

…

actions_scoped_workflow_test.go

fix(workflows): branch protection status checks fail when workflow uses on: paths filter (#38237)

2026-07-01 21:47:47 +02:00

actions_settings_test.go

…

actions_trigger_test.go

fix(workflows): branch protection status checks fail when workflow uses on: paths filter (#38237)

2026-07-01 21:47:47 +02:00

actions_variables_test.go

…

admin_config_test.go

…

admin_user_test.go

…

api_actions_artifact_test.go

…

api_actions_artifact_v4_test.go

…

api_actions_permission_test.go

…

api_actions_run_test.go

…

api_actions_runner_test.go

…

api_admin_org_test.go

…

api_admin_test.go

…

api_auth_test.go

…

api_branch_test.go

…

api_comment_attachment_test.go

…

api_comment_test.go

…

api_fork_test.go

…

api_gitignore_templates_test.go

…

api_gpg_keys_test.go

…

api_helper_for_declarative_test.go

…

api_httpsig_test.go

…

api_issue_attachment_test.go

…

api_issue_config_test.go

…

api_issue_dependency_test.go

…

api_issue_label_test.go

…

api_issue_lock_test.go

…

api_issue_milestone_test.go

…

api_issue_pin_test.go

…

api_issue_reaction_test.go

…

api_issue_stopwatch_test.go

…

api_issue_subscription_test.go

…

api_issue_templates_test.go

…

api_issue_test.go

…

api_issue_tracked_time_test.go

…

api_keys_test.go

…

api_label_templates_test.go

…

api_license_templates_test.go

…

api_notification_test.go

…

api_oauth2_apps_test.go

…

api_org_avatar_test.go

…

api_org_test.go

…

api_packages_alpine_test.go

…

api_packages_arch_test.go

…

api_packages_cargo_test.go

…

api_packages_chef_test.go

…

api_packages_composer_test.go

…

api_packages_conan_test.go

…

api_packages_conda_test.go

…

api_packages_container_test.go

…

api_packages_cran_test.go

…

api_packages_debian_test.go

…

api_packages_generic_test.go

…

api_packages_goproxy_test.go

…

api_packages_helm_test.go

…

api_packages_maven_test.go

…

api_packages_npm_test.go

…

api_packages_nuget_test.go

…

api_packages_pub_test.go

…

api_packages_pypi_test.go

…

api_packages_rpm_test.go

…

api_packages_rubygems_test.go

…

api_packages_swift_test.go

…

api_packages_terraform_test.go

…

api_packages_test.go

…

api_packages_vagrant_test.go

…

api_private_serv_test.go

…

api_public_only_test.go

…

api_pull_commits_test.go

…

api_pull_review_test.go

…

api_pull_test.go

…

api_releases_attachment_test.go

…

api_releases_test.go

…

api_repo_archive_test.go

…

api_repo_avatar_test.go

…

api_repo_branch_test.go

…

api_repo_collaborator_test.go

…

api_repo_compare_test.go

…

api_repo_edit_test.go

…

api_repo_file_create_test.go

…

api_repo_file_delete_test.go

…

api_repo_file_diffpatch_test.go

…

api_repo_file_get_test.go

…

api_repo_file_helpers.go

…

api_repo_file_update_test.go

…

api_repo_files_change_test.go

…

api_repo_files_get_test.go

…

api_repo_get_contents_list_test.go

…

api_repo_get_contents_test.go

…

api_repo_git_blobs_test.go

…

api_repo_git_commits_test.go

fix: Improve since/until when counting commits for X-Total-Count (#38243)

2026-07-01 20:43:46 +00:00

api_repo_git_hook_test.go

…

api_repo_git_notes_test.go

…

api_repo_git_ref_test.go

…

api_repo_git_tags_test.go

…

api_repo_git_trees_test.go

…

api_repo_hook_test.go

…

api_repo_languages_test.go

…

api_repo_lfs_locks_test.go

…

api_repo_lfs_migrate_test.go

…

api_repo_lfs_test.go

…

api_repo_license_test.go

…

api_repo_raw_test.go

…

api_repo_secrets_test.go

…

api_repo_tags_test.go

…

api_repo_teams_test.go

…

api_repo_test.go

…

api_repo_topic_test.go

…

api_repo_variables_test.go

…

api_settings_test.go

…

api_team_test.go

…

api_team_user_test.go

…

api_token_self_test.go

…

api_token_test.go

…

api_twofa_test.go

…

api_user_avatar_test.go

…

api_user_block_test.go

…

api_user_email_test.go

…

api_user_follow_test.go

…

api_user_heatmap_test.go

…

api_user_info_test.go

…

api_user_org_perm_test.go

…

api_user_orgs_test.go

…

api_user_public_only_test.go

…

api_user_search_test.go

…

api_user_secrets_test.go

…

api_user_star_test.go

…

api_user_update_test.go

…

api_user_variables_test.go

…

api_user_watch_test.go

…

api_wiki_test.go

…

attachment_test.go

fix(release): gate draft release attachments on web download endpoints (#38318)

2026-07-03 20:07:37 +02:00

auth_ldap_test.go

…

auth_oauth2_test.go

fix(oauth2): persist linkAccountData during auto-link 2FA flow (#38274)

2026-07-01 10:03:38 +00:00

avatar.png

…

branches_test.go

…

change_default_branch_test.go

…

cmd_keys_test.go

fix(deps): update go dependencies (#38194)

2026-06-29 15:10:47 +00:00

compare_test.go

…

config_instance_test.go

…

cors_test.go

…

create_no_session_test.go

…

db_collation_test.go

…

delete_user_test.go

…

download_test.go

…

dump_restore_test.go

…

editor_test.go

…

empty_repo_test.go

…

ephemeral_actions_runner_deletion_test.go

…

eventsource_test.go

…

explore_repos_test.go

…

explore_user_test.go

…

feed_repo_test.go

…

feed_user_test.go

…

git_general_test.go

…

git_helper_for_declarative_test.go

…

git_lfs_ssh_test.go

…

git_misc_test.go

…

git_push_test.go

…

git_smart_http_test.go

…

git_ssh_redirect_test.go

…

goget_test.go

…

gpg_ssh_git_test.go

…

heatmap_test.go

…

html_helper.go

…

incoming_email_test.go

…

integration_test.go

…

issue_test.go

…

issue_timetrack_test.go

…

lfs_getobject_test.go

…

lfs_local_endpoint_test.go

…

lfs_view_test.go

…

linguist_test.go

…

links_test.go

…

manual_merge_test.go

…

markup_external_test.go

…

migrate_test.go

…

mirror_pull_test.go

…

mirror_push_test.go

…

nonascii_branches_test.go

…

oauth_avatar_test.go

…

oauth_test.go

…

org_count_test.go

…

org_profile_test.go

…

org_project_test.go

…

org_team_invite_test.go

…

org_test.go

…

org_worktime_test.go

…

packages_service_test.go

…

private-testing.key

…

privateactivity_test.go

…

project_test.go

…

pull_comment_test.go

…

pull_commit_test.go

…

pull_compare_test.go

…

pull_create_test.go

…

pull_diff_test.go

…

pull_merge_test.go

…

pull_review_test.go

…

pull_status_test.go

…

pull_update_test.go

…

release_test.go

…

rename_branch_test.go

…

repo_activity_test.go

…

repo_archive_test.go

…

repo_branch_test.go

…

repo_commits_search_test.go

…

repo_commits_test.go

…

repo_fork_test.go

…

repo_generate_test.go

…

repo_merge_upstream_test.go

…

repo_migrate_test.go

…

repo_search_test.go

…

repo_tag_test.go

…

repo_test.go

…

repo_topic_test.go

…

repo_visibility_test.go

…

repo_watch_test.go

…

repo_webhook_test.go

…

repofiles_change_test.go

…

session_test.go

…

setting_test.go

…

signin_test.go

…

signout_test.go

…

signup_test.go

…

ssh_key_test.go

…

timetracking_test.go

…

user_avatar_test.go

…

user_settings_test.go

…

user_test.go

…

version_test.go

…

view_test.go

…

wiki_test.go

…

workflow_run_api_check_test.go

…