Commit Graph
2 Commits
Author SHA1 Message Date
e7fca90a78 Fix get release draft permission check (#36659) (#36715)
Backport #36659 by @lunny

Draft release and it's attachments need a write permission to access.

Signed-off-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2026-02-22 22:09:07 +00:00
Kemal ZebariandGitHub 7adc4717ec Include file extension checks in attachment API (#32151)
From testing, I found that issue posters and users with repository write
access are able to edit attachment names in a way that circumvents the
instance-level file extension restrictions using the edit attachment
APIs. This snapshot adds checks for these endpoints.
2024-11-06 21:34:32 +00:00