mirrors/forgejo
1
1
Fork 1
mirror of https://codeberg.org/forgejo/forgejo synced 2025-10-18 23:00:43 +02:00
Code Issues Projects Releases Packages Wiki Activity
forgejo/routers/api
History
Exact
Gusted a76099ca94 fix: require password login for creation of new token 
- The creation of new API tokens for users via the API is guarded behind
a extra check. This extra makes sure the user is authorized via the
reverse proxy method (if enabled) or via basic authorization.
- For, what seems to me, historical reasons the basic authorization also
handles logging in via the API token.
- This results in a API token (with `write:user` scope) or OAuth2 token
being able to create a new API token with escalated privileges.
- Add a new condition to this check to ensure the user logged in via
password.
- Change error to better indicate what went wrong.

(cherry picked from commit 85e839e21d)
2025-08-30 11:13:36 +00:00
..
actions [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
forgejo/v1 [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
packages [v11.0/forgejo] storage test: reader should not be closed on save (#9031) 2025-08-26 10:20:00 +02:00
shared [v11.0/forgejo] chore: branding import path (#7354) 2025-03-27 20:13:05 +00:00
v1 fix: require password login for creation of new token 2025-08-30 11:13:36 +00:00