mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-31 19:55:02 +00:00
5a3f06430d
Backport https://github.com/go-gitea/gitea/pull/39945 API tokens and Actions task tokens could see data beyond their scope through user-scoped API routes and web profile pages. - Actions task tokens authenticate as a shared system user with a negative ID, which org, project and SSH/GPG key filters treated as "no owner filter". These filters now check `!= 0`, so system users own nothing. The `/api/v1/user` routes except `GET /api/v1/user` only accept individual and bot accounts, and repo search no longer skips access checks for the owner. - `/{username}` only accepts tokens for RSS/Atom feeds. HTML profile and org pages render as anonymous for token requests. - User and org feeds require `read:user` or `read:organization` from tokens, the same way repo feeds require `read:repository`. `release/v28` lacks https://github.com/go-gitea/gitea/pull/39967, so `/{username}` enables basic auth only for feed requests through a middleware. The profile page token tests from https://github.com/go-gitea/gitea/pull/39853 are folded into `TestFeedUser`, because profile pages no longer accept tokens. Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: Giteabot <teabot@gitea.io>