TheAfriForge/gitforge
1
0
Fork 0
mirror of https://codeberg.org/forgejo/forgejo.git synced 2026-07-12 20:48:40 +00:00
Code Issues Projects Releases Packages Wiki Activity
gitforge/release-notes
History
Mathieu Fenniak 84ae61f2ce fix: compliance with [migrations].ALLOWED_DOMAINS, ...BLOCKED_DOMAINS, and ....ALLOW_LOCALNETWORKS for git & LFS ops (#13129) 
System administrators can determine which hosts can be accessed by Forgejo for git mirroring via the config settings `[migrations].ALLOWED_DOMAINS`, `...BLOCKED_DOMAINS`, and `....ALLOW_LOCALNETWORKS`.  However, there were edge cases where these settings were ineffective:

- Config entries were only checked when mirrors were initially configured, and not later when a mirror pull/push occurred.  DNS changes, or server configuration changes, could cause a previously safe URL to no longer be safe.  These settings are now re-checked on every mirror pull/push.
- When accessing a git repository over http, git would follow HTTP redirects, allowing a violation of the `[migrations]` config entries.  The git option `http.followRedirects=false` is now set to prevent git from following these redirects.
- When performing Git LFS synchronization, it was assumed that the git URL passing migration URL checks was sufficient protection.  Specifically for pull mirrors which allow the usage of "Advanced settings" -> "LFS endpoint" to configure a separate LFS endpoint, these settings were never enforced, and for all mirrors they would have been subject to not being rechecked if the DNS had changed since configured.  LFS mirroring now uses an HTTP client that enforces the `[migrations]` config settings.

**Breaking:** If a repository mirror that depends on HTTP redirects will no longer work.

For example, if you've mirrored a repository from a Forgejo instance at `https://example.com/OWNER/REPO.git` and the repository or owner are renamed, Forgejo will provide an HTTP redirect that continues to allow git operations to work at the old URL.  Due to this redirect prohibition, this mirror will no longer work.

### Tests for Go changes

- I added test coverage for Go changes...
  - [x] in their respective `*_test.go` for unit tests.
  - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server.
- I ran...
  - [x] `make pr-go` before pushing

### Documentation

- [x] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change.
    - It is not currently documented that the `[migrations]` settings are used to control access to mirrors.  Forgejo advises it when an error occurs, but it could be added: https://codeberg.org/forgejo/docs/pulls/2023
- [ ] I did not document these changes and I do not expect someone else to do it.

### Release notes

- [x] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change.
- [ ] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change.

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/13129
Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org>
2026-06-23 23:40:25 +02:00
..
3139.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3285.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3307.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3334.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3337.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3363.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
3383.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3414.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3430.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3434.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3442.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3642.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3654.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3723.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3724.md Adjust codespell config + make it fix few typos which sneaked in since addition of codespell support (#4857) 2024-08-08 16:07:35 +00:00
3729.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
3752.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
3791.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3808.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3811.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3830.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3836.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3838.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3847.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
3870.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3886.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3917.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
3934.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3952.md chore(release-notes): fix release notes of chroma update in v8.0.0 2025-10-05 17:10:38 +05:00
3985.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
3989.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
4026.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4027.md Adjust codespell config + make it fix few typos which sneaked in since addition of codespell support (#4857) 2024-08-08 16:07:35 +00:00
4072.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
4083.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
4095.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4125.md [Feat]Add link to show all Issues/PullRequests (#4125) 2024-10-09 04:56:40 +00:00
4134.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4136.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4139.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
4143.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4145.md docs(release-notes): proofread multiline release-notes files 2024-07-15 21:22:56 +02:00
4160.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4189.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4201.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4212.md feat(quota): Add a terse release not about quotas 2024-08-02 11:10:34 +02:00
4218.md docs(release-notes): fix artifact range requests 2024-07-10 08:52:06 +02:00
4222.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4240.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4253.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4262.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4266.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4291.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4367.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4375.md
4400.md
4427.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4429.md
4439.md docs(release-notes): flatten release-notes files 2024-07-11 14:20:34 +02:00
4487.md [BUG] Don't fire notification for comment of pending review 2024-08-18 17:04:00 +02:00
4506.md [CHORE] Use github.com/ProtonMail/go-crypto 2024-07-15 17:27:37 +02:00
4547.md [UI] Convert milestone to HTMX 2024-07-17 14:52:00 +02:00
4595.md added release notes for pr 4595 2024-07-23 18:47:42 +02:00
4605.md feat: allow .webp attachments by default 2024-07-21 13:01:08 +05:00
4607.md Add a release note for cherry-picked features 2024-07-22 15:46:01 +02:00
4635.md [SECURITY] Notify users about account security changes 2024-07-23 18:31:47 +02:00
4684.md Forgejo v9.0 is GPLv3+ 2024-08-22 09:09:29 +02:00
4716.md chore(release-notes): weekly cherry-pick week 2024-31 2024-07-28 09:00:29 +02:00
4724.md cherry-pick OIDC changes from gitea (#4724) 2024-08-08 06:32:14 +00:00
4801.md chore(release-notes): weekly cherry-pick week 2024-32 2024-08-04 18:24:10 +02:00
4819.md [FEAT] Allow pushmirror to use publickey authentication 2024-08-22 17:05:07 +02:00
4907.md add release notes 2024-08-13 22:14:46 +01:00
4924.md chore(release-notes): weekly cherry-pick week 2024-33 2024-08-13 09:05:50 +02:00
4941.md [CHORE] Drop go-git support 2024-08-12 19:11:09 +02:00
4998.md chore(release-notes): weekly cherry-pick week 2024-34 2024-08-19 09:27:37 +02:00
5065.md chore(release-notes): workflow_dispatch parsing error fix 2024-08-23 08:37:00 +02:00
5090.md [CHORE] Move to new sessioner library 2024-08-25 03:47:08 +02:00
5109.md chore(release-notes): weekly cherry-pick week 2024-35 2024-08-26 07:44:20 +02:00
5120.md chore(release-notes): Update module github.com/go-enry/go-enry/v2 to v2.8.9 2024-08-26 09:54:03 +02:00
5149.md [SEC] Ensure propagation of API scopes for Conan and Container authentication 2024-08-28 10:33:32 +02:00
5195.md chore(release-notes): weekly cherry-pick week 2024-36 2024-09-01 08:39:30 +02:00
5205.md chore(release-notes): Update dependency mermaid v11.2.0 2024-09-14 10:55:08 +02:00
5325.md [gitea] week 2024-38 cherry pick (gitea/main -> forgejo) (release notes) 2024-09-20 07:11:08 +02:00
5372.md chore(release-notes): weekly cherry-pick week 2024-39 2024-09-27 08:47:23 +02:00
5384.md Move web app manifest to a own cache-able route and add a setting to set "display": "standalone"; Closes #2638 (#5384) 2026-01-09 17:49:29 +01:00
5416.md chore(release-notes): weekly cherry-pick week 2024-40 2024-09-29 11:35:18 +02:00
5459.md chore(release-notes): Update dependency mermaid to v11.3.0 2024-10-04 08:53:11 +02:00
5477.md chore(release-notes): weekly cherry-pick week 2024-41 2024-10-06 08:21:41 +02:00
5515.md chore(release-note): Fix bug when a token is given public only 2024-10-10 16:00:16 +03:00
5543.md chore(release-notes): weekly cherry-pick week 2024-42 2024-10-13 14:17:08 +03:00
5601.md chore(release-notes): Update module github.com/go-enry/go-enry/v2 to v2.9.1 2024-10-18 10:12:06 +02:00
5621.md chore(release-notes): notes for week 2024-43 weekly cherry pick 2024-10-22 18:14:27 +02:00
5677.md feat: Add partial quoting 2024-10-26 19:15:43 +02:00
5714.md chore(release-notes): notes for the week 2024-44 weekly cherry pick 2024-10-27 11:27:40 +01:00
5718.md security: add permission check to 'delete branch after merge' 2024-10-28 05:48:10 +01:00
5719.md fix(sec): use constant time check for internal token 2024-10-28 06:25:52 +01:00
5751.md chore(release-notes): Update dependency mermaid to v11.4.0 2024-10-31 07:15:14 +01:00
5778.md chore(release-notes): related pull requests workflow fixes 2024-11-04 12:10:15 +01:00
5789.md chore(release-notes): notes for the week 2024-45 weekly cherry pick 2024-11-05 09:39:24 +01:00
5974.md chore(release-notes): 15 November 2024 security fixes 2024-11-15 11:17:14 +01:00
5988.md chore(release-notes): notes for the week 2024-46 weekly cherry pick 2024-11-16 15:25:37 +01:00
5997.md chore(release-notes): notes for the week 2024-47 weekly cherry pick 2024-11-18 19:20:54 +01:00
6062.md chore(release-notes): notes for the week 2024-48 weekly cherry pick 2024-11-24 15:43:19 +00:00
6110.md chore(release-notes): notes for the week 2024-49 weekly cherry pick 2024-12-03 10:21:20 +01:00
6200.md chore(release-notes): notes for the week 2024-50 weekly cherry pick 2024-12-08 09:10:58 +01:00
6271.md chore(release-notes): notes for the week 2024-51 weekly cherry pick 2024-12-15 10:16:04 +01:00
6351.md Release-note and file rename for Alt Linux Apt-RPM support (#6656) 2025-01-23 07:22:05 +00:00
6445.md add release notes 2025-01-01 19:50:39 +01:00
6471.md chore(release-notes): notes for the week 2025-02 weekly cherry pick 2025-01-05 13:47:27 +00:00
6523.md feat(ui): create a comment aggregator to reduce noise in issues (#6523) 2025-03-05 17:24:51 +00:00
6553.md chore(release-notes): add chroma update to v10.0.0 release notes 2025-10-05 17:24:51 +05:00
6639.md fix: teach the doctor about orphaned two_factor rows (#6639) 2025-01-21 17:30:08 +00:00
6763.md chore(release-notes): notes for the week 2025-06 weekly cherry pick 2025-02-02 12:05:46 +01:00
6813.md Reimplement editor Tab handling with accessibility safeguards (#6813) 2025-05-25 19:17:03 +02:00
6933.md Show if commit is signed in activity feed and unify sha box (#6933) 2025-05-03 10:54:52 +00:00
7251.md fix: discard v25 secrets migrations errors instead of failing (#7251) 2025-03-17 16:25:37 +00:00
7459.md chore(release-notes): add chroma update to v12.0.0 release notes 2025-10-05 17:43:06 +05:00
7607.md chore(release-notes): add chroma update to v12.0.0 release notes 2025-10-05 17:43:06 +05:00
7738.md chore(release-notes): add chroma update to v12.0.0 release notes 2025-10-05 17:43:06 +05:00
7890.md chore(release-notes): add chroma update to v12.0.0 release notes 2025-10-05 17:43:06 +05:00
8035.md chore(upgrade): urfave/cli from v2 to v3 (#8035) 2025-06-01 22:16:37 +02:00
8393.md chore(release-notes): add chroma update to v13.0.0 release notes 2025-10-05 17:50:35 +05:00
8502.md Update module code.forgejo.org/forgejo/act to v1.32.0 (forgejo) (#8502) 2025-07-23 01:01:31 +02:00
8783.md chore(release-notes): add chroma update to v13.0.0 release notes 2025-10-05 17:50:35 +05:00
9023.md fix!: use run ID instead of run Index in artifacts download web views 2025-08-27 08:53:20 +02:00
9362.md fix: do not display the title of unsubscribed issues or pull requests in the notification web page (#9362) 2025-09-19 22:32:06 +02:00
9373.md feat: add foreign keys to stopwatch & tracked_time tables (#9373) 2025-10-01 00:31:38 +02:00
9458.md fix!: detect extra cmdline args and emit errors (#9458) 2025-10-08 18:20:28 +02:00
9513.md fix!: prevent forked .profile repositories from displaying profile content (#9513) 2025-10-07 18:53:57 +02:00
9638.md feat: strip EXIF information from uploaded avatars (#9638) 2025-10-13 23:16:17 +02:00
9830.md feat: replace cross origin protection (#9830) 2025-10-29 22:43:22 +01:00
9848.md chore: add release notes for backports of v11 and v13 [skip ci] (#9857) 2025-10-26 04:51:04 +01:00
9849.md chore: add release notes for backports of v11 and v13 [skip ci] (#9857) 2025-10-26 04:51:04 +01:00
10010.md feat: ensure only expected ssh public keys are in authorized_keys file (#10010) 2025-11-09 01:06:04 +01:00
10380.md feat: Follow remote users; feed tab (#10380) 2026-04-12 03:31:03 +02:00
10397.md feat: replace repo based server-side hooks with centralised hooks (#10397) 2026-04-27 22:34:46 +02:00
10645.md branding!: make cookies brand independent (#10645) 2026-03-19 04:34:27 +01:00
11096.md fix(ui)!: remove squash merge committer trailer admin option (#11096) 2026-02-07 12:58:26 +01:00
11098.md chore(Dockerfile.rootless): remove legacy config file support (#11098) 2026-03-02 06:03:39 +01:00
11194.md chore: unify signing key configuration across modules (#11194) 2026-04-21 19:39:33 +02:00
11282.md fix: prevent panic on gitlab import (releases/issues) (#11282) 2026-03-03 21:36:14 +01:00
11365.md fix(ui): improve Git notes editing (#11365) 2026-03-10 23:49:18 +01:00
11437.md feat: implement repo-specific access tokens broadly for universal API permission checks (#11437) 2026-02-28 19:47:06 +01:00
11457.md docs: add release notes for PR #11457 2026-03-01 17:05:53 +01:00
11458.md docs: add release notes for PR #11458 2026-03-01 10:54:43 -07:00
11514.md chore: release notes from #11514 & #11515 backports 2026-03-08 20:07:52 -06:00
11515.md chore: release notes from #11514 & #11515 backports 2026-03-08 20:07:52 -06:00
11699.md fix: add missing deleting beans for organizations (#11699) 2026-03-17 09:11:52 +01:00
11736.md feat: ensure repo-specific access tokens can't perform repo admin operations (#11736) 2026-03-20 16:14:36 +01:00
12095.md feat: support simple JSON API for PyPI package registry (#12095) 2026-04-30 16:58:28 +02:00
12293.md fix: verify PR author has write access to head to support allow maintainers edit (#12292) 2026-04-29 05:26:22 +02:00
12294.md fix: verify PR author has write access to head to support allow maintainers edit (#12292) 2026-04-29 05:26:22 +02:00
12295.md fix: verify PR author has write access to head to support allow maintainers edit (#12292) 2026-04-29 05:26:22 +02:00
12302.md fix: Prevent unremovable review requests after submitting pending reviews (#12302) 2026-05-08 05:52:59 +02:00
12335.md feat: prevent default git templates to be created (#12335) 2026-05-30 14:02:03 +02:00
12366.md fix: in actions_service cancelJobsForRun is bugous use killRun instead (#12366) 2026-05-09 04:46:56 +02:00
12494.md 2026-05-12 security patches (#12493) 2026-05-12 04:54:25 +02:00
12495.md 2026-05-12 security patches (#12493) 2026-05-12 04:54:25 +02:00
12666.md feat(api): expose action job + run logs via REST (#12666) 2026-05-30 01:45:32 +02:00
13002.md 2026-06-10 security patches (#13001) 2026-06-10 06:05:01 +02:00
13003.md 2026-06-10 security patches (#13001) 2026-06-10 06:05:01 +02:00
13129.md fix: compliance with [migrations].ALLOWED_DOMAINS, ...BLOCKED_DOMAINS, and ....ALLOW_LOCALNETWORKS for git & LFS ops (#13129) 2026-06-23 23:40:25 +02:00