peezy-tech/jojo
2
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2026-05-13 06:20:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
jojo/models/issues
History
Exact
Mathieu Fenniak 9b76ac6cec [v11.0/forgejo] fix: verify PR author has write access to head to support allow maintainers edit (#12295) 
Backport: https://codeberg.org/forgejo/forgejo/pulls/12292

When a pull request is opened, the author is able to mark that pull request to "Allow edits from maintainers", which grants the maintainers of the pull request's repo access to edit the pull request branch contents.  It is possible to create a pull request where the pull request author does not have the ability to edit the pull request branch.  Due to a missing security check for this case, maintainers of the pull request repo would be granted the ability to edit the pull request branch, even if the author of the pull request did not have that ability.  By exploiting this missing security check, a user can edit any branch in a repository if they're able to fork that repository.  The issue is being fixed by restricting the scope of "Allow edits from maintainers" to only grant that access if the pull request author also had access to edit the branch.

Thanks to Arvin Shivram of Brutecat Security for discovering and responsibly disclosing the vulnerability.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12295
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
2026-04-29 05:29:46 +02:00
..
TestGetUIDsAndStopwatch fix: use better code to group UID and stopwatches 2024-11-16 15:59:02 +01:00
action_aggregator.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
assignees.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
assignees_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
comment.go fix: check that attachments belong to correct resource 2026-03-06 11:20:50 -07:00
comment_code.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
comment_list.go [v11.0/forgejo] fix: load OldMilestone based on OldMilestoneID, not MilestoneID (#8522) 2025-07-16 18:20:39 +02:00
comment_list_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
comment_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
content_history.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
content_history_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
dependency.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
dependency_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_index.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_index_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_label.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_label_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_list.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_list_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_lock.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_project.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_project_test.go [v11.0/forgejo] chore: merge tests.AddFixtures and unittest.OverrideFixtures (#7649) 2025-04-25 09:59:30 +00:00
issue_search.go [v11.0/forgejo] fix: do not display the title of unsubscribed issues or pull requests in the notification web page (#9363) 2025-09-19 23:20:03 +02:00
issue_stats.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_stats_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_test.go [v11.0/forgejo] fix: do not display the title of unsubscribed issues or pull requests in the notification web page (#9363) 2025-09-19 23:20:03 +02:00
issue_update.go fix: check that attachments belong to correct resource 2026-03-06 11:20:50 -07:00
issue_user.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_user_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_watch.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_watch_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_xref.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
issue_xref_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
label.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
label_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
main_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
milestone.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
milestone_list.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
milestone_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
pull.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
pull_list.go [v11.0/forgejo] fix: verify PR author has write access to head to support allow maintainers edit (#12295) 2026-04-29 05:29:46 +02:00
pull_test.go [v11.0/forgejo] chore: merge tests.AddFixtures and unittest.OverrideFixtures (#7649) 2025-04-25 09:59:30 +00:00
reaction.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
reaction_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
review.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
review_list.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
review_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
stopwatch.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
stopwatch_test.go [v11.0/forgejo] chore: merge tests.AddFixtures and unittest.OverrideFixtures (#7649) 2025-04-25 09:59:30 +00:00
tracked_time.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
tracked_time_test.go [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00