gitea

mirror of https://github.com/go-gitea/gitea.git synced 2026-08-02 13:49:03 +00:00

Files

Giteabot ab10e37acf fix(release): gate draft release attachments on web download endpoints (#38318 ) (#38325 )

Backport #38318 by @bircni

Draft-release access control was enforced only on the API release
endpoints (`/api/v1/repos/{owner}/{repo}/releases/...`) but not on the
UUID-based web attachment endpoints (`/attachments/{uuid}`,
`/{owner}/{repo}/attachments/{uuid}`,
`/{owner}/{repo}/releases/attachments/{uuid}`).

Anyone who obtained an attachment UUID — including unauthenticated
callers — could download files belonging to a hidden draft release,
since `ServeAttachment` only checked repo-level read permission and
never the release's draft state.

This extends `ServeAttachment` to require write access to releases when
the attachment belongs to a draft release, mirroring the existing
API-side `canAccessReleaseDraft` gate. A regression test is included.

Co-authored-by: bircni <bircni@icloud.com>

2026-07-03 20:34:37 +02:00

e2e

refactor: replace legacy delete-button with link-action (#38143 )

2026-06-18 12:02:11 +00:00

fuzz

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )

2026-05-26 15:49:31 -07:00

gitea-lfs-meta

Test views of LFS files (#22196 )

2022-12-23 07:41:56 +08:00

gitea-repositories-meta

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873 )