forgejo/routers/web
Jason Song edf98a2dc3
Require approval to run actions for fork pull request (#22803)
Currently, Gitea will run actions automatically which are triggered by
fork pull request. It's a security risk, people can create a PR and
modify the workflow yamls to execute a malicious script.

So we should require approval for first-time contributors, which is the
default strategy of a public repo on GitHub, see [Approving workflow
runs from public
forks](https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks).

Current strategy:

- don't need approval if it's not a fork PR;
- always need approval if the user is restricted;
- don't need approval if the user can write;
- don't need approval if the user has been approved before;
- otherwise, need approval.

https://user-images.githubusercontent.com/9418365/217207121-badf50a8-826c-4425-bef1-d82d1979bc81.mov

GitHub has an option for that, you can see that at
`/<owner>/<repo>/settings/actions`, and we can support that later.

<img width="835" alt="image"
src="https://user-images.githubusercontent.com/9418365/217199990-2967e68b-e693-4e59-8186-ab33a1314a16.png">

---------

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2023-02-24 15:58:49 +08:00
..
admin Refactor the setting to make unit test easier (#22405) 2023-02-20 00:12:01 +08:00
auth Provide the ability to set password hash algorithm parameters (#22942) 2023-02-19 15:35:20 +08:00
events Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
explore Remove ONLY_SHOW_RELEVANT_REPOS setting (#21962) 2023-02-04 21:26:38 +08:00
feed Use link in UI which returned a relative url but not html_url which contains an absolute url (#21986) 2023-02-06 12:09:18 -06:00
healthcheck Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
misc Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
org Scoped labels (#22585) 2023-02-18 21:17:39 +02:00
repo Require approval to run actions for fork pull request (#22803) 2023-02-24 15:58:49 +08:00
shared Add Cargo package registry (#21888) 2023-02-05 18:12:31 +08:00
user Provide the ability to set password hash algorithm parameters (#22942) 2023-02-19 15:35:20 +08:00
auth.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
auth_windows.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
base.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
goget.go refactor some functions to support ctx as first parameter (#21878) 2022-12-03 10:48:26 +08:00
home.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
metrics.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
nodeinfo.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
swagger_json.go Implement FSFE REUSE for golang files (#21840) 2022-11-27 18:20:29 +00:00
web.go Require approval to run actions for fork pull request (#22803) 2023-02-24 15:58:49 +08:00
webfinger.go Add context cache as a request level cache (#22294) 2023-02-15 21:37:34 +08:00