gitforge/modules
elle da8d5a8aef activitypub: restrict HTTP redirects (#13369)
Restricts the ActivityPub `Client`'s inner HTTP client to disallow HTTP redirects.

Resolves: #13368

## Checklist

The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org).

### Tests for Go changes

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
- I ran...
  - [x] `make pr-go` before pushing

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13369
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
2026-07-10 01:14:44 +02:00
..
actions fix: do not try to remove task logs that don't exist (#13040) 2026-06-11 02:03:05 +02:00
activitypub activitypub: restrict HTTP redirects (#13369) 2026-07-10 01:14:44 +02:00
analyze
assetfs
auth feat: add dynamic group mappings for OIDC (#11656) 2026-05-22 12:38:20 +02:00
avatar chore: remove EXIF stripping capability due to usage of AGPL licensed exif-terminator library (#13105) 2026-06-17 16:16:35 +02:00
avatarstore feat: serve downsized versions of avatars (#11242) 2026-05-16 12:04:05 +02:00
base refactor(tests): drop the need to compile gitea binary manually (#12855) 2026-06-02 00:04:50 +02:00
cache fix(ui): in the admin config panel do not report a cache taking more than 100 microseconds as slow (#13256) 2026-06-30 12:06:06 +02:00
card
charset
container
csv
emoji
eventsource
forgefed
generate
git fix: terminate git (& other) subcommands gracefully on context timeout/cancellation (#13263) 2026-07-01 20:26:02 +02:00
gitrepo
graceful
hcaptcha
highlight fix(ui): show "Shell" instead of "Bash" in headers of shell script files (#12562) 2026-05-14 22:33:51 +02:00
hostmatcher
html
httpcache feat: remove no-transform in Cache-Control header. (#12905) 2026-06-03 05:38:47 +02:00
httplib
indexer enh(issue-search): treat terms in query strings with no explicit operator as MUST (#13025) 2026-07-04 16:05:50 +02:00
issue/template
json feat: ability to edit authorized integration in web UI (#12601) 2026-05-17 18:33:39 +02:00
jwtx chore: make use of go1.26 features (#12369) 2026-05-01 22:51:48 +02:00
keying
label
lfs feat: enable auth to git LFS via authorized integrations (#12725) 2026-05-28 23:20:58 +02:00
log fix: terminate git (& other) subcommands gracefully on context timeout/cancellation (#13263) 2026-07-01 20:26:02 +02:00
markup feat(ui): improve markup attention colors (#13224) 2026-07-07 06:33:16 +02:00
mcaptcha
metrics
migration feat: show progress of issues and PRs migrations (#12738) 2026-05-28 00:49:07 +02:00
nosql feat: cache OIDC metadata & JWKS when read by authorized integration (#12275) 2026-04-28 02:13:06 +02:00
optional chore: upgrade to https://code.forgejo.org/xorm/xorm v1.4.0 (#12639) 2026-05-20 20:20:08 +02:00
options
packages fix: Update swift package registry to use the metadata schema from the official Swift docs (#12200) 2026-06-26 04:25:56 +02:00
paginator
pprof
private
process fix: intermittent test failure in process cancellation (#13293) 2026-07-04 04:49:36 +02:00
proxy
proxyprotocol
public
queue feat: cache OIDC metadata & JWKS when read by authorized integration (#12275) 2026-04-28 02:13:06 +02:00
recaptcha
references
regexplru
repository feat: granular settings for watched repo units (#10927) 2026-07-09 19:51:10 +02:00
secret
session
setting federation: protect against SSRF attacks (#11795) 2026-07-08 02:03:17 +02:00
sitemap
ssh fix: terminate git (& other) subcommands gracefully on context timeout/cancellation (#13263) 2026-07-01 20:26:02 +02:00
storage tests: minioClient web proxy (#13340) 2026-07-07 21:46:35 +02:00
structs fix(api): swagger docs improvement (#13082) 2026-06-13 21:20:26 +02:00
svg
sync
system
templates fix(ui): bring back non-empty check to ThemeName (#13175) 2026-06-23 11:53:17 +02:00
test fix: ensure migrations allow/deny host lists are applied to onedev, pagure, and codebase migrators (#13184) 2026-06-25 14:11:36 +02:00
testimport
testlogger
timeutil
translation chore(i18n): May 2026 maintenence (#12718) 2026-05-25 10:59:49 +02:00
turnstile
typesniffer
updatechecker
uri
user
util chore: make use of go1.26 features (#12369) 2026-05-01 22:51:48 +02:00
validation feat: add dynamic group mappings for OIDC (#11656) 2026-05-22 12:38:20 +02:00
web Update module github.com/go-chi/chi/v5 to v5.3.0 (forgejo) (#12697) 2026-06-29 23:35:12 +02:00
webhook
zstd