bircni 9e84deb969 fix: Various sec fixes 2 (#38108) ...

- Enforce repository token scope on RSS/Atom feed endpoints so a PAT
without repo scope can no longer read private repo commit data.
- Block HTTP redirects during repository migration clones to prevent
SSRF reaching internal addresses via an attacker-controlled redirect.
- Redact the notification subject after repo access is revoked so
private issue/PR metadata is no longer leaked through the notification
API.

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

2026-06-17 06:50:25 +02:00

..

e2e

fix: csp regressions (#38047)

2026-06-12 08:36:05 +08:00

fuzz

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

gitea-lfs-meta

…

gitea-repositories-meta

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

integration

fix: Various sec fixes 2 (#38108)

2026-06-17 06:50:25 +02:00

testdata/data

…

mssql.ini.tmpl

Refactor integration tests infrastructure (#37462)

2026-04-29 16:37:38 +00:00

mysql.ini.tmpl

Refactor integration tests infrastructure (#37462)

2026-04-29 16:37:38 +00:00

pgsql.ini.tmpl

Refactor integration tests infrastructure (#37462)

2026-04-29 16:37:38 +00:00

sqlite.ini.tmpl

fix: allow git clone of private repos with anonymous code access (#38074)

2026-06-13 12:02:02 +08:00

test_utils.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00