foster/forgejo
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2024-11-22 08:42:32 -05:00
Code Issues Wiki Activity
forgejo/services
History
Gusted 02db188a50 [SEC] Ensure propagation of API scopes for Conan and Container authentication 
- The Conan and Container packages use a different type of
authentication. It first authenticates via the regular way (api tokens
or user:password, handled via `auth.Basic`) and then generates a JWT
token that is used by the package software (such as Docker) to do the
action they wanted to do. This JWT token didn't properly propagate the
API scopes that the token was generated for, and thus could lead to a
'scope escalation' within the Conan and Container packages, read
access to write access.
- Store the API scope in the JWT token, so it can be propagated on
subsequent calls that uses that JWT token.
- Integration test added.
- Resolves #5128

(cherry picked from commit 5a871f6095)
2024-08-28 08:45:05 +00:00
..
actions enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
agit fix(agit): run full pr checks on force-push 2024-08-13 18:26:41 +00:00
asymkey enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
attachment enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
auth Fix tautological conditions (#30735) 2024-05-05 08:59:40 +01:00
automerge [PORT] Fix agit automerge (gitea#31881) 2024-08-21 17:05:34 +02:00
context [BUG] Allow 4 charachter SHA in /src/commit 2024-08-06 01:18:48 +00:00
contexttest enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
convert enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
cron enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
doctor fix: correct doctor commands and rename to forgejo 2024-08-27 01:44:08 +00:00
externalaccount [Fix] Account Linking UpdateMigrationsByType (#31428) 2024-06-23 12:40:53 +02:00
f3 enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
federation feat(federated-star) star repositories via ActivityPub (#1680) 2024-06-06 08:58:11 +02:00
feed enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
forgejo enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
forms Add slogan config (#3752) 2024-06-07 17:12:48 +00:00
gitdiff enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
indexer Update issue indexer after merging a PR (#30715) 2024-05-12 20:03:10 +02:00
issue enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
lfs Fix #31185 try fix lfs download from bitbucket failed (#31201) 2024-06-16 13:42:59 +02:00
mailer enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
markup enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
migrations enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
mirror test(mock): DeletePushMirrors & AddPushMirrorRemote 2024-06-02 16:31:41 +02:00
notify Clean up log messages (#30313) 2024-04-15 20:01:35 +02:00
org enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
packages [SEC] Ensure propagation of API scopes for Conan and Container authentication 2024-08-28 08:45:05 +00:00
pull Revert "Prevent allow/reject reviews on merged/closed PRs" 2024-08-15 10:47:38 +01:00
release enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
remote Enable unparam linter (#31277) 2024-06-16 13:42:58 +02:00
repository enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
secrets Refactor deletion (#28610) 2023-12-25 21:25:29 +01:00
task Fix "force private" logic (#31012) 2024-05-26 18:20:33 +02:00
uinotification Penultimate round of db.DefaultContext refactor (#27414) 2023-10-11 04:24:07 +00:00
user enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
webhook enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00
wiki enable linter testifylint on v8 (#4573) 2024-07-30 19:41:27 +00:00