Repository navigation
Tags
Tags
merge commit: [v16.0/forgejo] 2026-08-20 security patches (#13985) Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13985 Reviewed-by: 0ko <0ko@noreply.codeberg.org>
merge commit: [v15.0/forgejo] 2026-08-20 security patches (#13986) Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13986 Reviewed-by: 0ko <0ko@noreply.codeberg.org>
[v16.0/forgejo] 2026-07-30 security patches (#13682) **fix: prevent arbitrary file reads from org-mode rendering**: When rendering org-mode content, the rendering library has a default configuration that permits inclusion of files from the server host, and Forgejo did not modify this configuration. As a result, files from the server host could be read through Forgejo. The rendering library is now being configured to block all filesystem access. **fix: prevent stored XSS in Actions pre-execution warnings and errors**: When Forgejo detects a condition in Forgejo Actions which will either prevent a workflow from running successfully, or, indicates a condition that the workflow author should be warned about, Forgejo contains error and warning conditions that will be displayed in the UI. These messages may include unsanitized user content which can be exploited as a stored cross-site scripting vulnerability (XSS). All content being inserted into these messages is now sanitized. This patch addresses the stored XSS vulnerability even with existing stored content. Co-authored-by: Gusted <postmaster@gusted.xyz> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13682 Reviewed-by: Gusted <gusted@noreply.codeberg.org>
[v15.0/forgejo] fix: disable hooks during diff patch (#13705) Thanks to NightRang3r for the discovery: GHSA-rcr6-4jqh-j84m Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13705 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
[v16.0/forgejo] fix: Initialize oauth2 only if enabled (#13483) (#13540) Fixes #13478 Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13483 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> Reviewed-by: Gusted <gusted@noreply.codeberg.org> (cherry picked from commit f538db4) Co-authored-by: Nils Goroll <nils.goroll@uplex.de> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13540 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org> Reviewed-by: Gusted <gusted@noreply.codeberg.org>
[v16.0/forgejo] chore: Update link to policy in security.txt (#13475) **Backport:** https://codeberg.org/forgejo/forgejo/pulls/13468 Co-authored-by: Beowulf <beowulf@beocode.eu> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13475 Reviewed-by: 0ko <0ko@noreply.codeberg.org>
[v15.0/forgejo] fix: don't terminate subprocesses when SSH connection… … is closed (internal SSH) (#13450) **Backport:** https://codeberg.org/forgejo/forgejo/pulls/13443 Fixes #13440. ## Testing Manual testing was performed with an automated reproduction. Attached `main.go` program was used to test go-git interaction with a server using `START_SSH_SERVER = true`. This test app uses go-git to perform an ssh-based push, which replicates the behaviour described in #13440. After dropping main.go into an empty directory, the test app can be run with: ``` go mod init repro go mod tidy REPRO_REPO_URL=ssh://mfenniak@localhost:2222/mfenniak/test.git go run main.go ``` When the fix is **not** present, the database/repository desync warning is shown after running the test command, which indicates that the hooks were interrupted and did not update the database state of the `main` branch:  When this fix **is** present, the database/repository desync warning does not appear, which indicates that the hooks were not interrupted. Repeated test in both modes 3x times to ensure there were no race conditions involved. While it would be possible to incorporate this test into Forgejo's integration testing suite, it would require adding a dependency to `go-git`. As Go doesn't have a concept of test-only dependencies, that would make `go-git` a dependency... which we just recently removed by removing it from Forgejo Runner's jobparser library. It would make `go-git` available for accidental incorporation into Forgejo's code, where it does not behave the same as Forgejo's internal git CLI libraries. Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13450 Reviewed-by: Gusted <gusted@noreply.codeberg.org>
[v15.0/forgejo] fix: don't cache write permission on first pushed git… … reference (#13372) Forgejo's git pre-receive hook validates whether the authenticated user can write to the target branch during a push operation. A caching performance optimization in the hook caused the pre-receive hook to validate only the first branch reference in the push. While typically a push operation has the same rights for all branches on a repository, some exceptions exist which could allow a user to push to a branch, pass the validation, and then bypass checks on additional references due to the cache. The cache has been removed, forcing all references to be validated for code write permissions. Thanks to Gitea for identifying this issue in go-gitea/gitea@f258119. This effort has been re-engineered for Forgejo, consistent with Forgejo's AI Agreement. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13372 Reviewed-by: Gusted <gusted@noreply.codeberg.org>
[v11.0/forgejo] fix: don't cache write permission on first pushed git… … reference (#13373) Forgejo's git pre-receive hook validates whether the authenticated user can write to the target branch during a push operation. A caching performance optimization in the hook caused the pre-receive hook to validate only the first branch reference in the push. While typically a push operation has the same rights for all branches on a repository, some exceptions exist which could allow a user to push to a branch, pass the validation, and then bypass checks on additional references due to the cache. The cache has been removed, forcing all references to be validated for code write permissions. Thanks to Gitea for identifying this issue in go-gitea/gitea@f258119. This effort has been re-engineered for Forgejo, consistent with Forgejo's AI Agreement. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13373 Reviewed-by: Gusted <gusted@noreply.codeberg.org>
PreviousNext