5 people 3e5256b6ca fix(api): check unit read permission in issue sub-resource endpoints (#39885) (#39938) ...

Backport #39885 by @basavaraj-sm05

Several `/repos/{owner}/{repo}/issues/{index}/...` API endpoints load
the issue by index without checking
`CanReadIssuesOrPulls(issue.IsPull)`, unlike `GetIssue`,
`ListIssueComments` and `GetIssueReactions`. The route group's
`mustEnableIssuesOrPulls` passes when the caller can read either unit,
so someone who can read issues but not pull requests (a team with only
the Issues unit, or per-unit anonymous access on a public repo) can read
a pull request's whole conversation through `/timeline`, plus its
labels, subscribers, attachments and tracked times, and can subscribe to
it. The reverse holds for issues.

These handlers now return 404 in that case, like their siblings.

Co-authored-by: Basavaraj S m <basavaraj@digiscrypt.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

2026-10-22 05:27:46 -07:00

..

api

fix(api): check unit read permission in issue sub-resource endpoints (#39885) (#39938)

2026-10-22 05:27:46 -07:00

common

fix(api): keep milestone due date when it is omitted in edit request (#39869) (#39921)

2026-10-21 17:59:21 +02:00

install

refactor: "install" page (#39400)

2026-09-23 23:14:31 +00:00

private

fix: various bugs (#39661) (#39667)

2026-10-07 10:11:58 -07:00

utils

Refactor flash message and remove SanitizeHTML template func (#37179)

2026-04-12 10:17:25 +08:00

web

fix(oauth2): decode form-encoded client credentials in HTTP Basic auth (#39926) (#39931)

2026-10-22 06:22:15 +00:00

init.go

fix(git)!: use internal proxy for all git operations (#39426)

2026-09-29 14:43:36 +02:00