mirror of
https://github.com/go-gitea/gitea.git
synced 2026-06-17 19:10:22 +03:00
bircni
9e84deb969
- Enforce repository token scope on RSS/Atom feed endpoints so a PAT without repo scope can no longer read private repo commit data. - Block HTTP redirects during repository migration clones to prevent SSRF reaching internal addresses via an attacker-controlled redirect. - Redact the notification subject after repo access is revoked so private issue/PR metadata is no longer leaked through the notification API. --------- Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
56 lines
1.3 KiB
Go
56 lines
1.3 KiB
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package feed
|
|
|
|
import (
|
|
"time"
|
|
|
|
"gitea.dev/models/db"
|
|
repo_model "gitea.dev/models/repo"
|
|
"gitea.dev/services/context"
|
|
|
|
"github.com/gorilla/feeds"
|
|
)
|
|
|
|
// shows tags and/or releases on the repo as RSS / Atom feed
|
|
func ShowReleaseFeed(ctx *context.Context, repo *repo_model.Repository, isReleasesOnly bool, formatType string) {
|
|
if !checkRepoFeedTokenScope(ctx) {
|
|
return
|
|
}
|
|
releases, err := db.Find[repo_model.Release](ctx, repo_model.FindReleasesOptions{
|
|
IncludeTags: !isReleasesOnly,
|
|
RepoID: ctx.Repo.Repository.ID,
|
|
})
|
|
if err != nil {
|
|
ctx.ServerError("GetReleasesByRepoID", err)
|
|
return
|
|
}
|
|
|
|
var title string
|
|
var link *feeds.Link
|
|
|
|
if isReleasesOnly {
|
|
title = ctx.Locale.TrString("repo.release.releases_for", repo.FullName())
|
|
link = &feeds.Link{Href: repo.HTMLURL() + "/release"}
|
|
} else {
|
|
title = ctx.Locale.TrString("repo.release.tags_for", repo.FullName())
|
|
link = &feeds.Link{Href: repo.HTMLURL() + "/tags"}
|
|
}
|
|
|
|
feed := &feeds.Feed{
|
|
Title: title,
|
|
Link: link,
|
|
Description: repo.Description,
|
|
Created: time.Now(),
|
|
}
|
|
|
|
feed.Items, err = releasesToFeedItems(ctx, releases)
|
|
if err != nil {
|
|
ctx.ServerError("releasesToFeedItems", err)
|
|
return
|
|
}
|
|
|
|
writeFeed(ctx, feed, formatType)
|
|
}
|