MirrorHub
/
gitea
mirror of https://github.com/go-gitea/gitea
0
0
Fork 0
Code Issues Releases Wiki Activity
gitea/routers/web/repo
History
Jason Song edf98a2dc3
Require approval to run actions for fork pull request (#22803) 
Currently, Gitea will run actions automatically which are triggered by
fork pull request. It's a security risk, people can create a PR and
modify the workflow yamls to execute a malicious script.

So we should require approval for first-time contributors, which is the
default strategy of a public repo on GitHub, see [Approving workflow
runs from public
forks](https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks).

Current strategy:

- don't need approval if it's not a fork PR;
- always need approval if the user is restricted;
- don't need approval if the user can write;
- don't need approval if the user has been approved before;
- otherwise, need approval.

https://user-images.githubusercontent.com/9418365/217207121-badf50a8-826c-4425-bef1-d82d1979bc81.mov

GitHub has an option for that, you can see that at
`/<owner>/<repo>/settings/actions`, and we can support that later.

<img width="835" alt="image"
src="https://user-images.githubusercontent.com/9418365/217199990-2967e68b-e693-4e59-8186-ab33a1314a16.png">

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
 		2023-02-24 15:58:49 +08:00
..
actions Require approval to run actions for fork pull request (#22803) 2023-02-24 15:58:49 +08:00
activity.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
attachment.go Add API management for issue/pull and comment attachments (#21783) 2022-12-09 14:35:56 +08:00
blame.go Add context cache as a request level cache (#22294) 2023-02-15 21:37:34 +08:00
branch.go Supports wildcard protected branch (#20825) 2023-01-16 16:00:22 +08:00
cherry_pick.go Rename almost all Ctx functions (#22071) 2022-12-10 10:46:31 +08:00
commit.go Add context cache as a request level cache (#22294) 2023-02-15 21:37:34 +08:00
compare.go Use beforeCommit instead of baseCommit (#22949) 2023-02-20 11:56:07 +08:00
download.go Use context parameter in models/git (#22367) 2023-01-09 11:50:54 +08:00
editor.go Rename almost all Ctx functions (#22071) 2022-12-10 10:46:31 +08:00
editor_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
find.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
http.go Rename `repo.GetOwner` to `repo.LoadOwner` (#22967) 2023-02-18 20:11:03 +08:00
http_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
issue.go Scoped labels (#22585) 2023-02-18 21:17:39 +02:00
issue_content_history.go Move helpers to be prefixed with `gt-` (#22879) 2023-02-13 17:59:59 +00:00
issue_dependency.go Fix improper HTMLURL usages in Go code (#22839) 2023-02-11 14:34:11 +08:00
issue_label.go Scoped labels (#22585) 2023-02-18 21:17:39 +02:00
issue_label_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
issue_lock.go Fix improper HTMLURL usages in Go code (#22839) 2023-02-11 14:34:11 +08:00
issue_stopwatch.go Fix improper HTMLURL usages in Go code (#22839) 2023-02-11 14:34:11 +08:00
issue_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
issue_timetrack.go Fix improper HTMLURL usages in Go code (#22839) 2023-02-11 14:34:11 +08:00
issue_watch.go Fix improper HTMLURL usages in Go code (#22839) 2023-02-11 14:34:11 +08:00
lfs.go Refactor git command package to improve security and maintainability (#22678) 2023-02-04 10:30:43 +08:00
main_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
middlewares.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
migrate.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
milestone.go Rename almost all Ctx functions (#22071) 2022-12-10 10:46:31 +08:00
packages.go Use dynamic package type list (#22263) 2022-12-29 00:31:54 +01:00
patch.go Fix commit name in Apply Patch page (#23086) 2023-02-23 15:14:07 -06:00
projects.go Preview images for Issue cards in Project Board view (#22112) 2023-02-11 16:12:41 +08:00
projects_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
pull.go Add force_merge to merge request and fix checking mergable (#23010) 2023-02-21 08:42:07 -06:00
pull_review.go Fix improper HTMLURL usages in Go code (#22839) 2023-02-11 14:34:11 +08:00
release.go Fix improper HTMLURL usages in Go code (#22839) 2023-02-11 14:34:11 +08:00
release_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
render.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
repo.go Fix improper HTMLURL usages in Go code (#22839) 2023-02-11 14:34:11 +08:00
runners.go Implement actions (#21937) 2023-01-31 09:45:19 +08:00
search.go Fix improper HTMLURL usages in Go code (#22839) 2023-02-11 14:34:11 +08:00
setting.go Rename `repo.GetOwner` to `repo.LoadOwner` (#22967) 2023-02-18 20:11:03 +08:00
setting_protected_branch.go Get rules by id when editing branch protection rule (#22932) 2023-02-20 19:30:41 +08:00
setting_secrets.go Add user secrets (#22191) 2023-02-01 20:53:04 +08:00
settings_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
tag.go Add main landmark to templates and adjust titles (#22670) 2023-02-01 22:56:10 +00:00
topic.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
treelist.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
view.go Rename `repo.GetOwner` to `repo.LoadOwner` (#22967) 2023-02-18 20:11:03 +08:00
view_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
webhook.go Add context cache as a request level cache (#22294) 2023-02-15 21:37:34 +08:00
wiki.go Use context parameter in models/git (#22367) 2023-01-09 11:50:54 +08:00
wiki_test.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00