upstream/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2026-05-28 11:14:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

chore: release notes from #11514 & #11515 backports

Browse source
This commit is contained in:
Mathieu Fenniak 2026-03-06 13:01:43 -07:00
parent 39078d478a
commit c69ba8b1c1
No known key found for this signature in database
2 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
release-notes/11514.md Normal file
View file

@ -0,0 +1,7 @@
- fix: PKCE challenges to Forgejo's OAuth identity provider were not validated when using the `S256` algorithm
- fix: Forgejo supports using an OAuth Bearer token with HTTP basic authentication, rather than Bearer token authentication, but did not properly apply the limited scopes of the OAuth grant
- fix: missing permission checks in attachment-related web endpoints allowed modifying attachments that a user did not own
- fix: email notifications for new releases could be sent to users that no longer access to the repository, or to inactive users
- fix: missing permission checks in user/org-owned projects would allow modifications of the open/closed state to be made to projects via insecure direct object references
- fix: missing permission checks in a web endpoint allowed cancellation of the automerge of a PR
- fix: prevent additional path-traversals in post-login redirect parameters that allowed for arbitrary redirects

7
release-notes/11515.md Normal file
View file

@ -0,0 +1,7 @@
- fix: PKCE challenges to Forgejo's OAuth identity provider were not validated when using the `S256` algorithm
- fix: Forgejo supports using an OAuth Bearer token with HTTP basic authentication, rather than Bearer token authentication, but did not properly apply the limited scopes of the OAuth grant
- fix: missing permission checks in attachment-related web endpoints allowed modifying attachments that a user did not own
- fix: email notifications for new releases could be sent to users that no longer access to the repository, or to inactive users
- fix: missing permission checks in user/org-owned projects would allow modifications of the open/closed state to be made to projects via insecure direct object references
- fix: missing permission checks in a web endpoint allowed cancellation of the automerge of a PR
- fix: prevent additional path-traversals in post-login redirect parameters that allowed for arbitrary redirects