3 people 0964106988 fix: add missing access checks and size limits (#39942) (#40085) ...

Backport https://github.com/go-gitea/gitea/pull/39942

Several handlers and parsers skipped checks that their siblings already
perform.

- Reject issue, comment, label, milestone and release mutations in
archived repositories via the API with one guard per route group,
matching the web UI
- Hide timeline references and dependencies pointing at issues the doer
cannot read, in the web UI and the API, including pull requests of the
same repository without pull request access
- Reject workflow runs with more than `MaxJobNumPerRun` jobs, including
inline reusable workflow jobs, and show rejected pushes as invalid
workflow runs
- Bound how much of a Helm chart archive is inflated while looking for
`Chart.yaml`

`release/v28` lacks two helpers this needs, so they are included:
`insertInvalidWorkflowRun`, split out of `handleInvalidWorkflows` by
https://github.com/go-gitea/gitea/pull/39480, and
`packages.NewLimitedReader` from
https://github.com/go-gitea/gitea/pull/39366.

Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-10-30 08:08:32 +01:00

..

artifact_test.go

fix(actions): bound requested artifact retention (#39894) (#39946)

2026-10-22 23:21:37 +00:00

artifact.go

fix(actions): bound requested artifact retention (#39894) (#39946)

2026-10-22 23:21:37 +00:00

config.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

main_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

run_attempt_list.go

feat: add deploy tokens (#37306)

2026-08-26 19:32:44 +00:00

run_attempt.go

fix(actions): preserve admitted jobs and runs in their concurrency group (#39461)

2026-09-29 04:36:33 +00:00

run_job_list_test.go

feat(actions): add build queue view (#38585)

2026-09-26 08:01:41 +00:00

run_job_list.go

fix(actions): preserve admitted jobs and runs in their concurrency group (#39461)

2026-09-29 04:36:33 +00:00

run_job_queue.go

feat(actions): add build queue view (#38585)

2026-09-26 08:01:41 +00:00

run_job_status_test.go

enhance(actions): add pending job status and align job statuses with GitHub (#39376)

2026-09-27 18:30:42 +00:00

run_job_summary.go

feat(actions): add job summaries (GITHUB_STEP_SUMMARY) (#37500)

2026-06-08 19:11:00 +00:00

run_job_test.go

fix(actions): settle cancelled reusable workflow runs stuck in cancelling (#39706) (#39717)

2026-10-10 09:13:47 -06:00

run_job.go

fix: add missing access checks and size limits (#39942) (#40085)

2026-10-30 08:08:32 +01:00

run_list_test.go

fix(actions): include all aggregable run statuses in status filter (#38280)

2026-06-30 19:59:30 +00:00

run_list.go

feat(actions)!: add RUN_RETENTION_DAYS to delete old action runs (#38855)

2026-08-22 21:32:59 +00:00

run_test.go

feat(actions): support owner-level and global scoped workflows (#38154)

2026-06-28 09:31:35 +00:00

run.go

fix: migrate broken team authorize access mode (#39579) (#39580)

2026-10-06 05:02:08 +00:00

runner_list.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

runner_test.go

feat(actions): update actionslib, support self:, misc fixes (#39358)

2026-09-25 00:06:42 +02:00

runner_token_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

runner_token.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

runner.go

feat(actions): update actionslib, support self:, misc fixes (#39358)

2026-09-25 00:06:42 +02:00

schedule_list.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

schedule_spec_test.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

schedule_spec.go

fix(actions): run every due schedule exactly once per occurrence (#39078)

2026-08-29 06:44:51 +00:00

schedule.go

fix(actions): fix schedule cleanup and default branch switch (#39740) (#39786)

2026-10-14 22:47:59 +00:00

scoped_workflow_test.go

feat(actions): support owner-level and global scoped workflows (#38154)

2026-06-28 09:31:35 +00:00

scoped_workflow.go

fix(db): make paginated database reads always require "order" option (#39017)

2026-08-23 08:18:18 +00:00

status_test.go

refactor: use the shared workflow model from actionslib (#38768)

2026-08-07 20:56:40 -07:00

status.go

enhance(actions): add pending job status and align job statuses with GitHub (#39376)

2026-09-27 18:30:42 +00:00

task_list.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

task_output.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

task_step.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

task_test.go

fix(actions): keep folded block scalars intact across serialization (#39787) (#39817)

2026-10-17 03:15:42 +00:00

task.go

fix(actions): keep folded block scalars intact across serialization (#39787) (#39817)

2026-10-17 03:15:42 +00:00

tasks_version.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

token_permissions.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

utils_test.go

fix(actions): never show negative running durations (#39322)

2026-09-15 21:33:17 +02:00

utils.go

fix(actions): never show negative running durations (#39322)

2026-09-15 21:33:17 +02:00

variable.go

fix(db): make paginated database reads always require "order" option (#39017)

2026-08-23 08:18:18 +00:00