mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-24 03:54:00 +09:00
2fd12d5f76
Backport #39944 by @basavaraj-sm05 The tags feed (`tags.rss` / `tags.atom`) lives in the tags route group, which only requires code read access, yet it lists every published release next to the plain tags and includes each release's title and rendered note. The releases page and `releases.rss` require releases read access, and the tags page only shows tag names to users without it, so the feed is the one place that leaks. A team member granted Code but not Releases on a private repo, or anyone on a public repo whose Releases unit is disabled, can read all release notes this way. I noticed it while comparing the feed routes with the tags template. When the doer cannot read releases, the feed now lists releases as plain tags, linking to `/src/tag/` like the tags page does. Co-authored-by: Basavaraj S m <basavaraj@digiscrypt.com>