Giteabot 53cf53cbbc fix: add missing checks to several handlers and services (#40120) (#40268) ...

Backport #40120 by @silverwind

Several code paths skipped checks their siblings perform, or cleaned up
more than they validated.

- Official team review requests now count, and removing one no longer
marks an unrelated review official
- Release edits only delete files of validated attachments
- Rejected container uploads no longer delete an existing blob
- Attachment removal only removes the uploader's own pending uploads
- OpenID sign-in checks the allow and block lists against the normalized
identifier
- HTTP git access is rejected while a repository is being created, like
SSH

Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: delvh <dev.lh@web.de>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-11-07 10:51:18 +00:00

..

archive_test.go

Move archive function to repo_model and gitrepo (#35514)

2025-10-06 15:01:26 -07:00

archiver.go

refactor: git repo and relative path handling (#38522)

2026-07-19 07:32:00 +00:00

attachment_test.go

fix: add missing checks to several handlers and models (#39839) (#39847)

2026-10-18 19:50:36 +02:00

attachment.go

fix: add missing checks to several handlers and services (#40120) (#40268)

2026-11-07 10:51:18 +00:00

avatar_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

avatar.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

collaboration_test.go

enhance: inherit team access for all units (#38938)

2026-08-17 20:30:24 +00:00

collaboration.go

fix(db): make paginated database reads always require "order" option (#39017)

2026-08-23 08:18:18 +00:00

fork_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

fork.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

git.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

issue.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

language_stats_test.go

fix(repo): avoid deadlock when updating language stats concurrently (#40167) (#40202)

2026-11-03 17:02:11 +00:00

language_stats.go

fix(repo): avoid deadlock when updating language stats concurrently (#40167) (#40202)

2026-11-03 17:02:11 +00:00

license.go

feat(licenses): support REUSE specification in licenses (#38720)

2026-08-03 07:34:53 +00:00

main_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

mirror.go

refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)

2026-06-27 10:24:02 -07:00

org_repo.go

fix: enforce public-only token scope and harden push options / locale parsing (#38323)

2026-07-10 16:39:01 +00:00

pull_request_default_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

pull_request_default.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

pushmirror_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

pushmirror.go

fix(db): make paginated database reads always require "order" option (#39017)

2026-08-23 08:18:18 +00:00

redirect_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

redirect.go

refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)

2026-06-27 10:24:02 -07:00

release_test.go

fix: add missing checks to several handlers and models (#39839) (#39847)

2026-10-18 19:50:36 +02:00

release.go

fix: add missing checks to several handlers and models (#39839) (#39847)

2026-10-18 19:50:36 +02:00

repo_indexer.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

repo_list_test.go

fix(repo): hide repositories of hidden owners (#39009)

2026-08-21 06:32:57 +00:00

repo_list.go

fix: harden context user access scope (#39945) (#40115)

2026-10-31 17:40:49 +01:00

repo_location_test.go

refactor: clean up git repo and model migration packages (#38564)

2026-07-23 01:22:26 +00:00

repo_location.go

refactor: hide git repo path details from more packages (#38601)

2026-07-23 17:42:55 +00:00

repo_test.go

fix: correct "go get" URL ssh scheme, fix form binding (#39674, #39528) (#39676)

2026-10-08 12:30:59 +00:00

repo_unit_actions_test.go

feat(actions): support owner-level and global scoped workflows (#38154)

2026-06-28 09:31:35 +00:00

repo_unit_actions.go

feat(actions): support owner-level and global scoped workflows (#38154)

2026-06-28 09:31:35 +00:00

repo_unit_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

repo_unit.go

chore: enable forcetypeassert linter, fix issues (#38804)

2026-08-09 10:25:06 +00:00

repo.go

perf: speed up repository issue and pull request lists (#40114) (#40132)

2026-10-31 18:24:15 +01:00

search.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

star_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

star.go

refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)

2026-06-27 10:24:02 -07:00

topic_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

topic.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

transfer.go

fix(repo): preserve transfer recipient collaboration (#39042)

2026-08-22 19:43:42 +00:00

update.go

fix(api): answer 409 when repository files already exist on disk (#40095) (#40098)

2026-10-30 22:26:30 +01:00

upload.go

chore: misc go 1.27 tweaks (#39069)

2026-08-24 18:26:10 +00:00

user_repo_test.go

fix: various security fixes (#38406)

2026-07-12 17:14:09 +00:00

user_repo.go

fix(db): make paginated database reads always require "order" option (#39017)

2026-08-23 08:18:18 +00:00

watch_test.go

fix: prevent system users from watching a repository (#39886) (#39895)

2026-10-20 20:27:42 +00:00

watch.go

perf: speed up the issue and pull request dashboards and fix table indices (#40001) (#40096)

2026-10-31 07:38:45 +00:00

wiki_test.go

refactor: git repo and relative path handling (#38522)

2026-07-19 07:32:00 +00:00

wiki.go

refactor: git repo and relative path handling (#38522)

2026-07-19 07:32:00 +00:00