Basavaraj S m 4f69599981 fix(repo): do not reuse pull mirror credentials for a new host (#39991) ...

Changing a pull mirror address with an empty password field carried the
stored credentials over to the new address. The password is write-only,
so a repo admin who did not set up the mirror could send the owner's
token to a host they control, or pull another repository on the same
host that the token can read.

Stored credentials are now reused only when the address is unchanged,
like a changed username already drops the stored password. The API
cannot change the address and push mirrors never reuse credentials, so
both are unaffected.

---------

Co-authored-by: silverwind <me@silverwind.io>

2026-11-07 12:35:10 +00:00

..

fileicon

chore(deps): update dependencies (#40168)

2026-11-02 19:30:55 +00:00

gitignore

Fix various typos in codebase (#35480)

2025-09-13 10:34:43 -04:00

label

feat: Add sorting by exclusive labels (issue priority) (#33206)

2025-04-10 17:18:07 +00:00

license

chore: update license files with line wrapping (#39726)

2026-10-11 00:57:21 +08:00

locale

fix(repo): do not reuse pull mirror credentials for a new host (#39991)

2026-11-07 12:35:10 +00:00

readme

Bindata is optional and over-writable on restart (#354)

2016-12-22 19:12:23 +01:00