silverwind 8cb6fb2001 fix: add missing checks to more handlers and services (#40131) ...

Several code paths skipped checks that their siblings already perform.

- Code comment replies are rejected when they target a review of another
pull request or another user's pending review
- OAuth2 refuses tokens for users who can't sign in, and introspection
reports their tokens and already used refresh tokens as inactive
- AGit proc-receive runs the same pull request permission and wiki
checks as pre-receive
- Repository transfer drops the repository's owner-level scoped workflow
source registrations, and registrations whose source the owner no longer
owns are ignored
- The web editor's base branch copy into a fork and the fork's upstream
divergence info require read access to the base repository
- LFS downloads require sign-in under strict `REQUIRE_SIGNIN_VIEW`, like
git smart HTTP
- Unknown AGit target branches are reported as an unexpected ref again

2026-11-08 09:02:51 +00:00

..

api

fix(pull): don't add a timeline entry for pending API reviews (#40260)

2026-11-07 14:19:50 +00:00

common

fix(web): don't block README images with REQUIRE_SIGNIN_VIEW = expensive (#40264)

2026-11-07 13:34:01 +00:00

install

refactor: "install" page (#39400)

2026-09-23 23:14:31 +00:00

private

fix: add missing checks to more handlers and services (#40131)

2026-11-08 09:02:51 +00:00

utils

Refactor flash message and remove SanitizeHTML template func (#37179)

2026-04-12 10:17:25 +08:00

web

fix: add missing checks to more handlers and services (#40131)

2026-11-08 09:02:51 +00:00

init.go

refactor!: remove go-git backend (#39487)

2026-10-03 10:04:24 +00:00