VibedByKaKi/forgejo-11-secure
1
0
Fork 0
mirror of https://github.com/VibedByKaKi/forgejo-11-secure.git synced 2026-10-19 00:38:06 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
forgejo-11-secure/tests/integration/fixtures/TestGetAttachmentViaAPITokens
History
Exact
Mathieu Fenniak 9e51a55b63 [v11.0/forgejo] 2026-05-12 security patches (#12495) 
- fix: prevent git write to wiki repo from unauthorized user via git HTTP
- fix: prevent LFS authorization token from being used for read/write access after user's access is restricted from Forgejo
- fix: prevent scoped API access (OAuth tokens, Access tokens) from accessing resources beyond their permitted scope via non-API endpoints (e.g. /user/repo/raw/...)
- fix: implementing missing OAuth validation checks, improve protections against race conditions
- fix: prevent OAuth redirect URI spoofing via non-ascii case collision
- fix: strengthen Actions Artifact V4 signature algorithm against spoofing attacks
- fix: update Go toolchain to 1.25.10

Co-authored-by: Derzsi Dániel <daniel@tohka.us>
Co-authored-by: jvoisin <julien.voisin@dustri.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12495
2026-05-12 04:54:30 +02:00
..
attachment.yml [v11.0/forgejo] 2026-05-12 security patches (#12495) 2026-05-12 04:54:30 +02:00
issue.yml [v11.0/forgejo] 2026-05-12 security patches (#12495) 2026-05-12 04:54:30 +02:00