Gitea-John71/Gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-08-22 21:53:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): enforce repository creation token authorization (#39007) (#39014)

Browse Source 
Backport #39007 by @bircni

Reject public-only tokens for repository migrations and require
repository scope for canonical organization repository creation. This
aligns both routes with the existing token authorization boundaries.

_Assisted-by: Codex:GPT-5_

Co-authored-by: bircni <bircni@icloud.com>
This commit is contained in:
Giteabot
2026-08-21 02:44:25 -07:00
committed by GitHub
parent 320b44df58
commit 76c768edca
3 changed files with 58 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routers/api/v1/api.go
+2 -2
View File
@@ -1243,7 +1243,7 @@ func Routes() *web.Router {
m.Get("/search", repo.Search)
// (repo scope)
m.Post("/migrate", reqToken(), bind(api.MigrateRepoOptions{}), repo.Migrate)
m.Post("/migrate", reqToken(), rejectPublicOnly(), bind(api.MigrateRepoOptions{}), repo.Migrate)
m.Group("/{username}/{reponame}", func() {
m.Get("/compare/*", reqRepoReader(unit.TypeCode), repo.CompareDiff)
@@ -1719,7 +1719,7 @@ func Routes() *web.Router {
Delete(reqToken(), reqOrgOwnership(), org.Delete)
m.Post("/rename", reqToken(), reqOrgOwnership(), bind(api.RenameOrgOption{}), org.Rename)
m.Combo("/repos").Get(user.ListOrgRepos).
Post(reqToken(), bind(api.CreateRepoOption{}), repo.CreateOrgRepo).
Post(reqToken(), tokenRequiresScopes(auth_model.AccessTokenScopeCategoryRepository), bind(api.CreateRepoOption{}), repo.CreateOrgRepo).
Delete(reqToken(), reqOrgOwnership(), tokenRequiresScopes(auth_model.AccessTokenScopeCategoryRepository), org.DeleteOrgRepos)
m.Group("/members", func() {
m.Get("", reqToken(), org.ListMembers)