foster/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-12-22 12:54:53 -05:00
Code Issues Wiki Activity
forgejo/release-notes/5718.md

2 lines
316 B
Markdown
Raw Permalink Normal View History

security: add permission check to 'delete branch after merge' - Add a permission check that the doer has write permissions to the head repository if the the 'delete branch after merge' is enabled when merging a pull request. - Unify the checks in the web and API router to `DeleteBranchAfterMerge`. - Added integration tests. (cherry picked from commit 266e0b2ce91ebd18858071d7702589971384402c)
2024-10-22 18:48:46 -04:00
Because of a missing permission check, the branch used to propose a pull request to a repository can always be deleted by the user performing the merge. It was fixed so that such a deletion is only allowed if the user performing the merge has write permission to the repository from which the pull request was made.
Copy permalink