silverwind 8cb6fb2001 fix: add missing checks to more handlers and services (#40131) ...

Several code paths skipped checks that their siblings already perform.

- Code comment replies are rejected when they target a review of another
pull request or another user's pending review
- OAuth2 refuses tokens for users who can't sign in, and introspection
reports their tokens and already used refresh tokens as inactive
- AGit proc-receive runs the same pull request permission and wiki
checks as pre-receive
- Repository transfer drops the repository's owner-level scoped workflow
source registrations, and registrations whose source the owner no longer
owns are ignored
- The web editor's base branch copy into a fork and the fork's upstream
divergence info require read access to the base repository
- LFS downloads require sign-in under strict `REQUIRE_SIGNIN_VIEW`, like
git smart HTTP
- Unknown AGit target branches are reported as an unexpected ref again

2026-11-08 09:02:51 +00:00

..

actions

fix: add missing checks to more handlers and services (#40131)

2026-11-08 09:02:51 +00:00

activities

refactor: remove duplicated and dead Go code (#40244)

2026-11-06 11:59:49 +00:00

admin

refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)

2026-06-27 10:24:02 -07:00

asymkey

fix: stop discarding file close and test setup errors (#39987)

2026-11-06 20:45:17 +00:00

audit

feat(auth)!: remove support for obsolete OpenID 2.0 draft (#40231)

2026-11-06 07:21:19 +00:00

auth

fix(auth): limit failed TOTP attempts per account (#39993)

2026-11-07 23:01:49 +00:00

avatars

fix(avatar): use sha256 and inline the federated avatar lookup (#38843)

2026-08-10 23:13:28 +00:00

db

refactor: remove UnmarshalHandleDoubleEncode patch and fix repo unit TODO (#39998)

2026-11-04 05:28:49 +00:00

dbfs

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

deploykey

feat: add deploy tokens (#37306)

2026-08-26 19:32:44 +00:00

fixtures

fix: add missing checks to more handlers and services (#40131)

2026-11-08 09:02:51 +00:00

git

perf(pull): load the repository once for all commit statuses (#39930)

2026-10-31 17:32:03 +01:00

gituser

fix(ui): too many participants shown in commit avatar stacks (#38689)

2026-07-29 12:39:35 +00:00

issues

fix(pull): don't add a timeline entry for pending API reviews (#40260)

2026-11-07 14:19:50 +00:00

organization

fix(org): enforce unique team names in the database (#40228)

2026-11-07 11:16:11 +00:00

packages

feat(packages): add private Terraform module registry (#38040)

2026-11-07 10:45:05 +00:00

perm

refactor: remove duplicated and dead Go code (#40244)

2026-11-06 11:59:49 +00:00

project

refactor: lazy init global regexp variables (#40269)

2026-11-07 11:56:56 +00:00

pull

fix: PR merge (#39442)

2026-09-26 17:38:42 +00:00

renderhelper

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

repo

refactor: lazy init global regexp variables (#40269)

2026-11-07 11:56:56 +00:00

repostats

refactor: use WithRepo instead of WithDir for most git operations, clean up model migrations (#38555)

2026-07-21 12:18:00 +00:00

secret

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

shared/types

feat: manage bot accounts from the admin UI, API and CLI (#38966)

2026-09-18 12:43:36 +00:00

system

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

unit

fix(projects): only require project write to move board cards (#40161)

2026-11-01 10:46:53 +00:00

unittest

fix: Fix OneDev migration with OneDev 16.8 and newer (#40017)

2026-10-26 09:48:18 +00:00

user

fix: truncate strings on character boundaries (#40267)

2026-11-07 11:15:28 +00:00

webhook

test: consolidate Go tests (#39962)

2026-10-24 13:48:19 +00:00

init.go

refactor: use WithRepo instead of WithDir for most git operations, clean up model migrations (#38555)

2026-07-21 12:18:00 +00:00