5 people 3e5256b6ca fix(api): check unit read permission in issue sub-resource endpoints (#39885) (#39938) ...

Backport #39885 by @basavaraj-sm05

Several `/repos/{owner}/{repo}/issues/{index}/...` API endpoints load
the issue by index without checking
`CanReadIssuesOrPulls(issue.IsPull)`, unlike `GetIssue`,
`ListIssueComments` and `GetIssueReactions`. The route group's
`mustEnableIssuesOrPulls` passes when the caller can read either unit,
so someone who can read issues but not pull requests (a team with only
the Issues unit, or per-unit anonymous access on a public repo) can read
a pull request's whole conversation through `/timeline`, plus its
labels, subscribers, attachments and tracked times, and can subscribe to
it. The reverse holds for issues.

These handlers now return 404 in that case, like their siblings.

Co-authored-by: Basavaraj S m <basavaraj@digiscrypt.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-10-22 05:27:46 -07:00

..

actions

fix(actions): bound request body size in artifacts v4 twirp handlers (#39818) (#39822)

2026-10-17 23:17:45 -07:00

packages

fix: enforce public-only token scope on more routes (#39690) (#39853)

2026-10-21 05:58:07 +00:00

v1

fix(api): check unit read permission in issue sub-resource endpoints (#39885) (#39938)

2026-10-22 05:27:46 -07:00