gitea

mirror of https://github.com/go-gitea/gitea.git synced 2026-05-17 18:21:59 +00:00

Files

Lunny Xiao f9b7b65371 fix(security): enforce wiki git writes and LFS token access at request time (#37695 )

This PR fixes two permission-checking gaps in Git and LFS request
handling.

## What it changes

- keep wiki Git HTTP pushes on the normal write-permission path, even
when proc-receive support is enabled
- revalidate LFS bearer token requests against the current user state
and current repository permissions before allowing access
- add regression coverage for unauthorized wiki HTTP pushes
- add LFS tests for blocked users, revoked repository access, read-only
upload attempts, and valid write access

## Why

- wiki repositories should not inherit the relaxed refs/for handling
used for normal code repositories
- LFS authorization tokens should not remain usable after a user is
disabled or loses repository access

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-05-15 08:12:59 +00:00

e2e

fix(deps): update dependency mermaid to v11.15.0 [security], add e2e test (#37662 )

2026-05-12 01:34:49 +02:00

fuzz

…

gitea-lfs-meta

…

gitea-repositories-meta

…

integration

fix(security): enforce wiki git writes and LFS token access at request time (#37695 )