forgejo/tests
Gergely Nagy 8eba631f8d
hooks: Harden when we accept push options that change repo settings
It is possible to change some repo settings (its visibility, and
template status) via `git push` options: `-o repo.private=true`, `-o
repo.template=true`.

Previously, there weren't sufficient permission checks on these, and
anyone who could `git push` to a repository - including via an AGit
workflow! - was able to change either of these settings. To guard
against this, the pre-receive hook will now check if either of these
options are present, and if so, will perform additional permission
checks to ensure that these can only be set by a repository owner or
an administrator. Additionally, changing these settings is disabled for
forks, even for the fork's owner.

There's still a case where the owner of a repository can change the
visibility of it, and it will not propagate to forks (it propagates to
forks when changing the visibility via the API), but that's an
inconsistency, not a security issue.

Signed-off-by: Gergely Nagy <forgejo@gergo.csillger.hu>
Signed-off-by: Earl Warren <contact@earl-warren.org>
2024-04-19 16:53:14 +02:00
..
e2e [CHORE] Remove println 2024-04-12 13:36:31 +02:00
fuzz Rework markup link rendering (#26745) 2024-01-15 08:49:24 +00:00
gitea-lfs-meta
gitea-repositories-meta Allow non-admin users to delete review requests (#29057) 2024-02-26 22:30:27 +01:00
integration hooks: Harden when we accept push options that change repo settings 2024-04-19 16:53:14 +02:00
testdata/data/attachments/a/0 Allow get release download files and lfs files with oauth2 token format (#26430) 2023-10-01 10:41:52 +00:00
mysql.ini.tmpl [CI] Forgejo Actions based CI (squash) all queues are immediate 2024-02-05 13:33:59 +01:00
pgsql.ini.tmpl [CI] Forgejo Actions based CI (squash) all queues are immediate 2024-02-05 13:33:59 +01:00
sqlite.ini.tmpl [TESTS] increase test-sqlite log level to Trace 2024-02-05 14:44:33 +01:00
test_utils.go fix(tests): 30s to cancel processes to avoid false negatives 2024-04-18 18:47:49 +02:00