Giteabot ab10e37acf fix(release): gate draft release attachments on web download endpoints (#38318) (#38325) ...

Backport #38318 by @bircni

Draft-release access control was enforced only on the API release
endpoints (`/api/v1/repos/{owner}/{repo}/releases/...`) but not on the
UUID-based web attachment endpoints (`/attachments/{uuid}`,
`/{owner}/{repo}/attachments/{uuid}`,
`/{owner}/{repo}/releases/attachments/{uuid}`).

Anyone who obtained an attachment UUID — including unauthenticated
callers — could download files belonging to a hidden draft release,
since `ServeAttachment` only checked repo-level read permission and
never the release's draft state.

This extends `ServeAttachment` to require write access to releases when
the attachment belongs to a draft release, mirroring the existing
API-side `canAccessReleaseDraft` gate. A regression test is included.

Co-authored-by: bircni <bircni@icloud.com>

2026-07-03 20:34:37 +02:00

..

admin

chore: fix form string abuse (#38106)

2026-06-14 18:26:22 +00:00

auth

fix(oauth2): persist linkAccountData during auto-link 2FA flow (#38274) (#38295)

2026-07-01 13:18:37 +02:00

devtest

fix(actions): show run index in run view and fix summary graph height (#38165)

2026-06-22 06:16:09 +00:00

events

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

explore

chore: fix form string abuse (#38106)

2026-06-14 18:26:22 +00:00

feed

fix: Various sec fixes 2 (#38108)

2026-06-17 06:50:25 +02:00

healthcheck

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

misc

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

org

feat(org): add team visibility so org members can discover teams (#37680)

2026-06-14 19:07:25 +00:00

repo

fix(release): gate draft release attachments on web download endpoints (#38318) (#38325)

2026-07-03 20:34:37 +02:00

shared

feat(actions): support owner-level and global scoped workflows (#38154)

2026-06-28 09:31:35 +00:00

user

perf: Various performance regression fixes (#38078)

2026-06-21 14:34:07 +00:00

base.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

githttp.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

goget.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

home.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

metrics.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

nodeinfo.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

passkey.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

swagger_json.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

web.go

feat(actions): support owner-level and global scoped workflows (#38154)

2026-06-28 09:31:35 +00:00

webfinger.go

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00