limiting-factor 3c92b40915 fix: comment attachment API is more restrictive than the web UI (#11623) ... The permission check for editing the attachments of a comment (adding or removing them) is changed to be the same as when editing the textual body of the comment. The poster of a comment can always edit it via the web UI, which includes the ability to remove or add attachments. It does not require write permission on the issue or pull unit of the repository. The API is consistent with the web UI in how it [verifies permissions for editing comments][0] when modifying the textual content. However, when adding or removing the attachments of a comment, it [also requires write permissions][1] on the issue or pull unit, which is inconsistent with the web UI and more restrictive. [0]: a581059606/routers/api/v1/repo/issue_comment.go (L606) [1]: a581059606/routers/api/v1/repo/issue_comment_attachment.go (L359) Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11623 Reviewed-by: Gusted <gusted@noreply.codeberg.org> Co-authored-by: limiting-factor <limiting-factor@posteo.com> Co-committed-by: limiting-factor <limiting-factor@posteo.com>		2026-03-19 01:39:29 +01:00
..
e2e	ui: move "New access token" to a separate UI page (#11659)	2026-03-18 22:33:14 +01:00
fuzz	chore: branding import path (#7337)	2025-03-27 19:40:14 +00:00
gitea-lfs-meta	Test views of LFS files (#22196)	2022-12-23 07:41:56 +08:00
gitea-repositories-meta	fix: Allow SHA-256 in PR commit URLs (#10309)	2025-12-16 00:45:00 +01:00
integration	fix: comment attachment API is more restrictive than the web UI (#11623)	2026-03-19 01:39:29 +01:00
testdata/data	add model viewer for .glb (GLTF) model in file view (#8111)	2025-06-21 14:42:35 +02:00
mysql.ini.tmpl	feat: match on compound filename extensions (#11439)	2026-03-19 01:25:51 +01:00
pgsql.ini.tmpl	feat: match on compound filename extensions (#11439)	2026-03-19 01:25:51 +01:00
sqlite.ini.tmpl	feat: match on compound filename extensions (#11439)	2026-03-19 01:25:51 +01:00
test_utils.go	refactor: replace Value() from Option[T] with Get() & ValueOrZeroValue() (#11218)	2026-02-10 16:41:21 +01:00