mirrors/forgejo
1
1
Fork 1
mirror of https://codeberg.org/forgejo/forgejo synced 2025-10-20 04:20:41 +02:00
Code Issues Projects Releases Packages Wiki Activity
forgejo/tests
History
Exact
forgejo-backport-action 5be039310c [v12.0/forgejo] fix: validate CSRF on non-safe methods (#9082) 
**Backport:** https://codeberg.org/forgejo/forgejo/pulls/9071

All PUT/DELETE routes in the web UI are validated to prevent a [cross site request forgery](https://en.wikipedia.org/wiki/Cross-site_request_forgery). Although all POST routes are validated with a CSRF token, some of the PUT/DELETE routes were missing this validation.

<!--start release-notes-assistant-->

## Release notes
<!--URL:https://codeberg.org/forgejo/forgejo-->
- Security bug fixes
  - [PR](https://codeberg.org/forgejo/forgejo/pulls/9071): <!--number 9071 --><!--line 0 --><!--description dmFsaWRhdGUgQ1NSRiBvbiBub24tc2FmZSBtZXRob2Rz-->validate CSRF on non-safe methods<!--description-->
<!--end release-notes-assistant-->

Co-authored-by: Gusted <postmaster@gusted.xyz>
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/9082
Reviewed-by: 0ko <0ko@noreply.codeberg.org>
Co-authored-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
Co-committed-by: forgejo-backport-action <forgejo-backport-action@noreply.codeberg.org>
2025-08-30 18:46:31 +02:00
..
e2e [v12.0/forgejo] fix: wrap items in gitignore dropdown (#8841) 2025-08-09 20:20:40 +02:00
fuzz
gitea-lfs-meta
gitea-repositories-meta [v12.0/forgejo] fix(ui): move file rename notice to before pagination (#8852) 2025-08-10 22:19:25 +02:00
integration [v12.0/forgejo] fix: validate CSRF on non-safe methods (#9082) 2025-08-30 18:46:31 +02:00
testdata/data add model viewer for .glb (GLTF) model in file view (#8111) 2025-06-21 14:42:35 +02:00
mysql.ini.tmpl [v12.0/forgejo] Revert "feat: remove API authentication methods that uses the URL query (#7924)" (#8653) 2025-07-24 17:53:11 +02:00
pgsql.ini.tmpl [v12.0/forgejo] Revert "feat: remove API authentication methods that uses the URL query (#7924)" (#8653) 2025-07-24 17:53:11 +02:00
sqlite.ini.tmpl [v12.0/forgejo] Revert "feat: remove API authentication methods that uses the URL query (#7924)" (#8653) 2025-07-24 17:53:11 +02:00
test_utils.go [v12.0/forgejo] fix: prevent pull requests from being merged multiple times (#8862) 2025-08-11 23:08:46 +02:00