Giteabot 500a09e044 fix(api): stop leaking private repo metadata after access revocation (#38321) (#38390) ...

Backport #38321 by @bircni

The `/user/starred` and `/user/subscriptions` endpoints returned private
repositories a user had starred/watched even after their access to those
repositories was revoked, still exposing the repository name,
description and visibility (including later metadata changes).

Private repositories in the starred/watched queries are now gated on the
actor's current access via `AccessibleRepositoryCondition`, so users who
no longer have access no longer receive the metadata. Public
repositories and public-only tokens are unaffected.

Co-authored-by: bircni <bircni@icloud.com>

2026-07-10 07:40:02 +00:00

..

e2e

test(e2e): fix race in pdf file render test (#38380) (#38381)

2026-07-09 13:57:50 +00:00

fuzz

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

gitea-lfs-meta

Test views of LFS files (#22196)

2022-12-23 07:41:56 +08:00

gitea-repositories-meta

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

integration

fix(api): stop leaking private repo metadata after access revocation (#38321) (#38390)

2026-07-10 07:40:02 +00:00

testdata/data

Add artifacts test fixture (#30300)

2024-11-01 10:29:54 +08:00

mssql.ini.tmpl

Refactor integration tests infrastructure (#37462)

2026-04-29 16:37:38 +00:00

mysql.ini.tmpl

Refactor integration tests infrastructure (#37462)

2026-04-29 16:37:38 +00:00

pgsql.ini.tmpl

Refactor integration tests infrastructure (#37462)

2026-04-29 16:37:38 +00:00

sqlite.ini.tmpl

fix: allow git clone of private repos with anonymous code access (#38074)

2026-06-13 12:02:02 +08:00

test_utils.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00