Skip to content

fix(security): harden access checks and migration validation - #38324

Merged
bircni merged 14 commits into
go-gitea:mainfrom
bircni:1.27-fixes
Jul 10, 2026
Merged

fix(security): harden access checks and migration validation#38324
bircni merged 14 commits into
go-gitea:mainfrom
bircni:1.27-fixes

Conversation

@bircni

@bircni bircni commented Jul 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Harden access checks for issue dependencies, team repository membership, notifications, stars, tracked times and repository migrations.

@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Jul 3, 2026
@bircni bircni added the backport/v1.27 This PR should be backported to Gitea 1.27 label Jul 3, 2026
@bircni
bircni marked this pull request as ready for review July 3, 2026 17:58
@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Jul 5, 2026
@bircni bircni mentioned this pull request Jul 7, 2026
Closed
22 tasks
lunny
lunny reviewed Jul 7, 2026
View reviewed changes
Comment thread routers/api/v1/repo/issue_tracked_time.go
lunny
lunny reviewed Jul 7, 2026
View reviewed changes
Comment thread routers/web/repo/issue_dependency.go Outdated
@bircni
bircni requested a review from lunny July 8, 2026 19:36
@bircni
bircni requested a review from a team July 9, 2026 13:02
Zettat123
Zettat123 reviewed Jul 9, 2026
View reviewed changes
Comment thread services/repository/collaboration.go Outdated
bircni added 2 commits July 10, 2026 18:51
@bircni
revert: "fix(repo): deactivate collaborator webhooks on removal"
096bc8e 
This reverts commit 0ac5f4e.

Repo-level webhooks always have owner_id = 0, so
DeactivateWebhooksByRepoAndOwner(repo.ID, collaborator.ID) can never
match any row -- the change was an inert no-op in production. The
webhook model records no creator for a repo webhook, so correctly
identifying a removed collaborator's webhooks needs a schema change.
Reverting until that is designed properly.

Assisted-by: Claude Code:claude-opus-4-8
@bircni
Merge remote-tracking branch 'origin/main' into 1.27-fixes
ca3a1b6
@bircni
bircni requested a review from Zettat123 July 10, 2026 16:54
@GiteaBot GiteaBot removed the lgtm/need 1 This PR needs approval from one additional maintainer to be merged. label Jul 10, 2026
@GiteaBot GiteaBot added the lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. label Jul 10, 2026
@bircni
bircni merged commit aab3242 into go-gitea:main Jul 10, 2026
29 checks passed
@GiteaBot GiteaBot added this to the 28.0.0 milestone Jul 10, 2026
@GiteaBot GiteaBot mentioned this pull request Jul 10, 2026
Merged
@GiteaBot GiteaBot added the backport/done All backports for this PR have been created label Jul 10, 2026
bircni pushed a commit that referenced this pull request Jul 10, 2026
@GiteaBot
fix(security): harden access checks and migration validation (#38324) (…
ed493f0 
…#38400)
@bircni
bircni deleted the 1.27-fixes branch July 10, 2026 18:30
zjjhot added a commit to zjjhot/gitea that referenced this pull request Jul 13, 2026
@zjjhot
Merge branch 'main' of https://github.com/go-gitea/gitea
5cef83c 
* 'main' of https://github.com/go-gitea/gitea:
  fix: various security fixes (go-gitea#38406)
  fix(util): reject invalid characters between time-estimate units (go-gitea#38416)
  feat(actions): implement adaptive auto-refresh for workflow runs list (go-gitea#38329)
  fix(turnstile): route CAPTCHA verification through the configured proxy (go-gitea#38412)
  fix: represent a deleted assignee team as a Ghost team (go-gitea#38413)
  [skip ci] Updated translations via Crowdin
  fix: refresh pull request merge box when the commit status is pending (go-gitea#38410)
  chore: remove Yarden Shoham from maintainers (go-gitea#38407)
  fix: actions task state concurrent update (go-gitea#38405)
  fix(actions): keep workflow run trailing on one row with long branch names (go-gitea#38382)
  fix(pull): re-evaluate review official flag on target branch change (go-gitea#38319)
  fix(web): use locale-aware date formatting for contribution calendar tooltips (go-gitea#38398)
  fix(security): harden access checks and migration validation (go-gitea#38324)
  fix: enforce public-only token scope and harden push options / locale parsing (go-gitea#38323)
  fix: co-author detection (go-gitea#38392)
  fix(api): stop leaking private repo metadata after access revocation (go-gitea#38321)
  fix(lfs): require proof of possession for cross-repo objects (go-gitea#38322)
  fix: incorrect co-author detection on commit page (go-gitea#38386)
zjjhot added a commit to zjjhot/gitea that referenced this pull request Jul 13, 2026
@zjjhot
Merge branch 'main' into mainzjj
4f04323 
* main:
  fix: various security fixes (go-gitea#38406)
  fix(util): reject invalid characters between time-estimate units (go-gitea#38416)
  feat(actions): implement adaptive auto-refresh for workflow runs list (go-gitea#38329)
  fix(turnstile): route CAPTCHA verification through the configured proxy (go-gitea#38412)
  fix: represent a deleted assignee team as a Ghost team (go-gitea#38413)
  [skip ci] Updated translations via Crowdin
  fix: refresh pull request merge box when the commit status is pending (go-gitea#38410)
  chore: remove Yarden Shoham from maintainers (go-gitea#38407)
  fix: actions task state concurrent update (go-gitea#38405)
  fix(actions): keep workflow run trailing on one row with long branch names (go-gitea#38382)
  fix(pull): re-evaluate review official flag on target branch change (go-gitea#38319)
  fix(web): use locale-aware date formatting for contribution calendar tooltips (go-gitea#38398)
  fix(security): harden access checks and migration validation (go-gitea#38324)
  fix: enforce public-only token scope and harden push options / locale parsing (go-gitea#38323)
  fix: co-author detection (go-gitea#38392)
  fix(api): stop leaking private repo metadata after access revocation (go-gitea#38321)
  fix(lfs): require proof of possession for cross-repo objects (go-gitea#38322)
  fix: incorrect co-author detection on commit page (go-gitea#38386)
@sec-reex

sec-reex commented Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Hi @bircni ,
Thank you for addressing this issue.

Could youplease request a CVE assignment for GHSA-qf2f-qh6p-7v89 through GitHub Security Advisories?
This will be very helpful for my current work.

Thank you.

@bircni

bircni commented Jul 18, 2026

Copy link
Copy Markdown
Member Author

I cannot but @lunny can

@lunny

lunny commented Jul 18, 2026

Copy link
Copy Markdown
Member

A CVE has been assigned to that issue.

@sec-reex

sec-reex commented Jul 19, 2026

Copy link
Copy Markdown

Thank you for your help, I am very grateful.

zeekay pushed a commit to hanzoai/git that referenced this pull request Jul 26, 2026
@bircni
fix(security): harden access checks and migration validation (go-gite…
93a031d 
…a#38324)

Harden access checks for issue dependencies, team repository membership,
notifications, stars, tracked times and repository migrations.
@dengbinbox dengbinbox mentioned this pull request Sep 3, 2026
Open
@rawsun007 rawsun007 mentioned this pull request Sep 4, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lafriks lafriks lafriks approved these changes
@Zettat123 Zettat123 Zettat123 approved these changes
@lunny lunny Awaiting requested review from lunny

Assignees

No one assigned

Labels

backport/done All backports for this PR have been created backport/v1.27 This PR should be backported to Gitea 1.27 lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. type/bug

Projects

None yet

Milestone

28.0.0

Development

Successfully merging this pull request may close these issues.

6 participants

@bircni @sec-reex @lunny @lafriks @Zettat123 @GiteaBot