Nicolas f25811942c fix: re-check branch write permission for every ref in a push ...

The pre-receive hook cached the result of CanWriteCode() after the first
ref in a batch push, but CanMaintainerWriteToBranch depends on the current
branch name. A user holding a per-branch maintainer-edit grant (an open PR
with "allow edits from maintainers") could batch that branch with protected
branches or tags and have the cached approval reused, escalating to full
repository write. Evaluate the permission fresh for every ref; the pusher
and base permission remain cached via loadPusherAndPermission.

Assisted-by: Claude:claude-opus-4-8

2026-06-13 18:38:06 +02:00

..

api

fix: block fork sync when base repo is no longer readable

2026-06-13 17:36:35 +02:00

common

fix(actions): return 404 when job log blob is missing (#38003)

2026-06-05 20:10:25 +02:00

install

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

private

fix: re-check branch write permission for every ref in a push

2026-06-13 18:38:06 +02:00

utils

Refactor flash message and remove SanitizeHTML template func (#37179)

2026-04-12 10:17:25 +08:00

web

fix: enforce single-use TOTP passcodes across all 2FA surfaces

2026-06-13 18:38:06 +02:00

init.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00