bircni
68692e19d4
fix: Various security fixes ( #38103 )
...
- Enforce org visibility on organization label read endpoints (private
org labels no longer leak to non-members).
- Block fork sync (`merge-upstream`) when the base repo is no longer
readable (stops pulling commits after a parent goes private).
- Remove `REVERSE_PROXY_LIMIT` / `REVERSE_PROXY_TRUSTED_PROXIES` from
the Docker `app.ini` templates (the `= *` default allowed
`X-WEBAUTH-USER` impersonation; reverse-proxy auth is now opt-in and
admin-configured).
- Enforce single-use TOTP passcodes across web login, password-reset,
and Basic-Auth `X-Gitea-OTP` (fixes a TOCTOU race and a stateless
replay).
- Re-check branch write permission for every ref in a push (the
pre-receive hook cached the first ref's result, letting a per-branch
maintainer-edit grant escalate to full repo write).
---------
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com >
2026-06-17 16:06:51 +00:00
..
2026-04-23 15:18:53 +00:00
2026-05-26 15:49:31 -07:00
2026-06-08 20:07:15 +00:00
2026-06-08 20:07:15 +00:00
2026-05-27 16:23:44 -07:00
2026-05-26 15:49:31 -07:00
2026-05-27 16:23:44 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-28 05:19:46 +02:00
2026-05-27 16:23:44 -07:00
2026-05-27 16:23:44 -07:00
2026-05-30 08:31:14 +02:00
2026-06-08 19:11:00 +00:00
2026-05-29 22:16:47 +02:00
2026-05-27 16:23:44 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-09 12:59:58 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-08 19:11:00 +00:00
2026-05-27 16:23:44 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-10 17:34:10 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-29 01:12:11 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-09 06:12:09 +00:00
2026-06-14 17:23:48 +02:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-17 06:39:22 +00:00
2026-06-17 16:06:51 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-29 01:12:11 +00:00
2026-05-26 15:49:31 -07:00
2026-05-28 17:53:38 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-17 06:39:22 +00:00
2026-06-03 16:21:48 -07:00
2026-05-26 15:49:31 -07:00
2026-06-15 09:37:15 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-09 06:12:09 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-14 19:07:25 +00:00
2026-05-26 15:49:31 -07:00
2026-06-14 20:05:18 +02:00
2026-05-26 15:49:31 -07:00
2026-06-17 16:06:51 +00:00
2026-06-17 06:39:22 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-08 16:58:42 +08:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-06 22:07:47 +00:00
2023-06-29 23:22:55 +00:00
2026-06-13 04:43:25 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-15 09:37:15 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-29 01:12:11 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-17 06:50:25 +02:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-08 18:18:58 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-13 12:02:02 +08:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-14 15:52:37 +02:00
2026-05-26 15:49:31 -07:00
2026-06-03 16:21:48 -07:00
2026-06-06 09:24:03 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-12 08:36:05 +08:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2022-09-02 15:18:23 -04:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-15 17:55:31 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-08 17:16:22 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-17 16:06:51 +00:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-27 16:23:44 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-05-26 15:49:31 -07:00
2026-06-06 11:06:08 +00:00
2026-06-11 17:12:30 +00:00