peezy-tech/jojo
2
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2026-05-14 06:50:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10
jojo/routers/api/actions
History
Mathieu Fenniak 32b8d732b8 2026-05-12 security patches (#12493) 
- fix: prevent git write to wiki repo from unauthorized user via git HTTP
- fix: prevent LFS authorization token from being used for read/write access after user's access is restricted from Forgejo
- fix: prevent scoped API access (OAuth tokens, Access tokens) from accessing resources beyond their permitted scope via non-API endpoints (e.g. /user/repo/raw/...)
- fix: implementing missing OAuth validation checks, improve protections against race conditions
- fix: prevent OAuth redirect URI spoofing via non-ascii case collision
- fix: strengthen Actions Artifact V4 signature algorithm against spoofing attacks

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/12493): <!--number 12493 --><!--line 0 --><!--description MjAyNi0wNS0xMiBzZWN1cml0eSBwYXRjaGVz-->2026-05-12 security patches<!--description-->
<!--end release-notes-assistant-->

Co-authored-by: Derzsi Dániel <daniel@tohka.us>
Co-authored-by: jvoisin <julien.voisin@dustri.org>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12493
2026-05-12 04:54:25 +02:00
..
ping chore: use code.forgejo.org/forgejo/actions-proto (#9981) 2025-11-05 16:10:52 +01:00
runner feat: allow runners to request a particular job (#11676) 2026-03-25 17:27:05 +01:00
actions.go feat: add OIDC workload identity federation support (#10481) 2026-01-15 03:39:00 +01:00
artifact.pb.go Actions Artifacts v4 backend (#28965) 2024-03-06 12:10:45 +08:00
artifact.proto Actions Artifacts v4 backend (#28965) 2024-03-06 12:10:45 +08:00
artifacts.go chore: fix typos throughout the codebase (#10753) 2026-01-26 22:57:33 +01:00
artifacts_chunks.go chore(cleanup): replaces unnecessary calls to formatting functions by non-formatting equivalents (#7994) 2025-05-29 17:34:29 +02:00
artifacts_utils.go chore: branding import path (#7337) 2025-03-27 19:40:14 +00:00
artifactsv4.go 2026-05-12 security patches (#12493) 2026-05-12 04:54:25 +02:00
id_token.go fix: prevent actions workflows from generating OIDC tokens if not authorized in workflow (#12030) 2026-04-08 15:42:39 +02:00
oidc.go chore: make use of go1.26 features (#12369) 2026-05-01 22:51:48 +02:00