mirrors
/
forgejo
mirror of
1
Fork 0
Code Issues Releases Activity
forgejo/services
History
Gusted ce10ec2878 [SEC] Ensure propagation of API scopes for Conan and Container authentication 
- The Conan and Container packages use a different type of
authentication. It first authenticates via the regular way (api tokens
or user:password, handled via `auth.Basic`) and then generates a JWT
token that is used by the package software (such as Docker) to do the
action they wanted to do. This JWT token didn't properly propagate the
API scopes that the token was generated for, and thus could lead to a
'scope escalation' within the Conan and Container packages, read
access to write access.
- Store the API scope in the JWT token, so it can be propagated on
subsequent calls that uses that JWT token.
- Integration test added.
- Resolves #5128

(cherry picked from commit 5a871f6095)
 		2024-08-28 08:44:58 +00:00
..
actions enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
agit fix(agit): run full pr checks on force-push 2024-08-13 18:26:33 +00:00
asymkey enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
attachment enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
auth fix: Fix to delete cookie when AppSubURL is non-empty (#30375) (#30469) 2024-04-21 17:39:14 +02:00
automerge Simplify how git repositories are opened (#28937) 2024-01-27 21:09:51 +01:00
context enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
contexttest enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
convert enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
cron enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
doctor fix: correct doctor commands and rename to forgejo 2024-08-27 01:44:00 +00:00
externalaccount Final round of `db.DefaultContext` refactor (#27587) 2023-10-14 08:37:24 +00:00
feed enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
forgejo enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
forms Return `access_denied` error when an OAuth2 request is denied (#30974) 2024-06-05 17:19:22 +02:00
gitdiff enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
indexer Update issue indexer after merging a PR (#30715) 2024-05-14 16:00:57 +02:00
issue enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
lfs Fix #31185 try fix lfs download from bitbucket failed (#31201) 2024-08-18 07:01:03 +02:00
mailer enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
markup enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
migrations enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
mirror test(mock): DeletePushMirrors & AddPushMirrorRemote 2024-06-02 15:45:31 +00:00
notify Clean up log messages (#30313) 2024-04-15 16:11:14 +02:00
org enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
packages [SEC] Ensure propagation of API scopes for Conan and Container authentication 2024-08-28 08:44:58 +00:00
pull fix(agit): run full pr checks on force-push 2024-08-13 18:26:33 +00:00
release enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
repository enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
secrets Refactor deletion (#28610) 2023-12-25 21:25:29 +01:00
task Fix incorrect ctx usage in defer function (#27740) 2023-10-22 14:12:27 +00:00
uinotification Penultimate round of `db.DefaultContext` refactor (#27414) 2023-10-11 04:24:07 +00:00
user enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
webhook enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00
wiki enable linter testifylint on v7 (#4572) 2024-07-30 19:42:06 +00:00