mirror of
https://github.com/go-gitea/gitea
synced 2024-12-23 23:56:00 +01:00
7adc4717ec
From testing, I found that issue posters and users with repository write access are able to edit attachment names in a way that circumvents the instance-level file extension restrictions using the edit attachment APIs. This snapshot adds checks for these endpoints. |
||
---|---|---|
.. | ||
activitypub | ||
admin | ||
misc | ||
notify | ||
org | ||
packages | ||
repo | ||
settings | ||
shared | ||
swagger | ||
user | ||
utils | ||
api.go |