5 people 01db50f0bf fix: enforce public-only token scope on more routes (#39690) (#39853) ...

Partial backport of https://github.com/go-gitea/gitea/pull/39690 with
only its public-only token checks, without the refactor.

1. Admin, org owner and repo or org creation APIs reject public-only
tokens.
1. Profile and org pages hide private repos and limited owners from
public-only tokens.
1. Heatmap API, OIDC userinfo and OCI blob mounts respect public-only
tokens.

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
Co-authored-by: bircni <bircni@icloud.com>

2026-10-21 05:58:07 +00:00

..

actions

fix(actions): keep folded block scalars intact across serialization (#39787) (#39817)

2026-10-17 03:15:42 +00:00

activities

feat: manage bot accounts from the admin UI, API and CLI (#38966)

2026-09-18 12:43:36 +00:00

admin

refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)

2026-06-27 10:24:02 -07:00

asymkey

fix: add missing checks to several handlers and models (#39839) (#39847)

2026-10-18 19:50:36 +02:00

audit

feat: manage bot accounts from the admin UI, API and CLI (#38966)

2026-09-18 12:43:36 +00:00

auth

enhance(oauth): pre-register a builtin OAuth2 application for gitea-vscode (#39785) (#39801)

2026-10-16 12:40:16 -07:00

avatars

fix(avatar): use sha256 and inline the federated avatar lookup (#38843)

2026-08-10 23:13:28 +00:00

db

fix: use READ_COMMITTED_SNAPSHOT on MSSQL (#39512) (#39558)

2026-10-03 08:21:46 +00:00

dbfs

chore: Move import path from code.gitea.io/gitea to gitea.dev (#37873)

2026-05-26 15:49:31 -07:00

deploykey

feat: add deploy tokens (#37306)

2026-08-26 19:32:44 +00:00

fixtures

feat: add deploy tokens (#37306)

2026-08-26 19:32:44 +00:00

git

fix(actions): harden log cursor, activity type and actor filter handling (#39721) (#39731)

2026-10-10 20:23:39 +00:00

gituser

fix(ui): too many participants shown in commit avatar stacks (#38689)

2026-07-29 12:39:35 +00:00

issues

enhance: allow custom watches to bypass on-mention email restriction (#39652) (#39837)

2026-10-18 12:45:52 +00:00

organization

feat(web): Add org removal functionality to admin user details page (#38013)

2026-08-29 07:50:04 +00:00

packages

fix: enforce public-only token scope on more routes (#39690) (#39853)

2026-10-21 05:58:07 +00:00

perm

feat(actions): update actionslib, support self:, misc fixes (#39358)

2026-09-25 00:06:42 +02:00

project

fix(projects): allow max columns to the limit (#39272)

2026-09-10 22:32:46 +02:00

pull

fix: PR merge (#39442)

2026-09-26 17:38:42 +00:00

renderhelper

fix(markup): resolve and proxy srcset links of <source> elements (#39708) (#39756)

2026-10-13 15:46:51 +08:00

repo

fix: prevent system users from watching a repository (#39886) (#39895)

2026-10-20 20:27:42 +00:00

repostats

refactor: use WithRepo instead of WithDir for most git operations, clean up model migrations (#38555)

2026-07-21 12:18:00 +00:00

secret

fix(db): make paginated database reads always require "order" option (#39017)

2026-08-23 08:18:18 +00:00

shared/types

feat: manage bot accounts from the admin UI, API and CLI (#38966)

2026-09-18 12:43:36 +00:00

system

refactor: Use db.Get[] instead of db.GetEngine(ctx).Get(bean) to avoid zero value fetching wrong database record (#37977)

2026-06-27 10:24:02 -07:00

unit

enhance: inherit team access for all units (#38938)

2026-08-17 20:30:24 +00:00

unittest

refactor: "install" page (#39400)

2026-09-23 23:14:31 +00:00

user

fix(mailer): reject incoming email tokens of users who cannot sign in (#39833) (#39841)

2026-10-18 12:28:08 +00:00

webhook

chore: misc go 1.27 tweaks (#39069)

2026-08-24 18:26:10 +00:00

init.go

refactor: use WithRepo instead of WithDir for most git operations, clean up model migrations (#38555)

2026-07-21 12:18:00 +00:00