gitea

mirror of https://github.com/go-gitea/gitea.git synced 2026-07-08 18:29:48 +00:00

Files

Giteabot 03372836ab fix(mirror): disable HTTP redirects on pull mirror sync (#38320 ) (#38367 )

Backport #38320 by @bircni

Pull mirror sync ran `git fetch` / `remote update` / `remote prune`
without disabling HTTP redirects. A mirror remote that later starts
redirecting to an otherwise-blocked or internal address could be used as
an SSRF/exfiltration vector on scheduled syncs, bypassing the
allow/block validation applied at migration time.

This sets `http.followRedirects=false` on all three remote-contacting
commands in the pull mirror path, matching the existing guard already
present on the clone path.

Co-authored-by: bircni <bircni@icloud.com>

2026-07-07 17:59:33 +00:00

mirror_pull_test.go

Fix mirror sync parser and fix mirror messages (#36504 )

2026-02-11 00:16:05 +00:00

mirror_pull.go

fix(mirror): disable HTTP redirects on pull mirror sync (#38320 ) (#38367 )

2026-07-07 17:59:33 +00:00

mirror_push.go

fix: Fix the panic when ssh remote lfs endpoint parsing failure (#38026 )

2026-06-18 07:54:16 +02:00

mirror.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )